Explorer of weird machines. Founder/CEO @bynar_io Prev: Immunity Inc

Joined July 2011
Alfredo Pesoli retweeted
You've probably seen plenty about PHP2Shell by now: two critical PHP vulnerabilities, potential unauthenticated RCE, and a lot of PoCs flying about. But what does responding to this actually look like for defenders? With AI accelerating the path from disclosure to exploit, there's less time to work through thousands of vulnerability findings and figure out what's relevant to your environment. In our latest post, we walk through how Precog helps triage PHP2Shell in your own environment, from identifying affected workloads and validating vulnerable behaviour against your actual application in a sandbox, through to prioritising fixes and guiding remediation. bynar.io/blog/php2shell-find…
4
2
12
6,762
Alfredo Pesoli retweeted
Replying to @Meta
@Meta patched my arbitrary code execution on the Meta Ray-Ban 😎 Blogpost or talk?
🤖 Made with AI
8
4
29
1,056
Alfredo Pesoli retweeted
Here's what happened last month at Bynario: - @daisyydaisy_ joined us 👀 - Company retreat in beautiful Franciacorta, Italy 🇮🇹 - 12 new vulns disclosed (CVE-2026-80795, CVE-2026-80794, CVE-2026-91945, ...) 😮‍💨 Find more information about our disclosures here bynar.io/disclosures
1
4
8
1,091
Alfredo Pesoli retweeted
Time to take a twitter break again for a few hours and do useful work. Please, can we stop assuming AI will not be subject to 2nd law of thermodynamics, cost of information acquisition, noisy channels, measurement errors, etc. etc. etc.
9
13
137
5,333
Alfredo Pesoli retweeted
MURIÓ ANDRÉS BLANCO, REFERENTE DEL HACKING ARGENTINO Tenía 44 años y era especialista en seguridad de redes Wi-Fi. Trabajó en Core Security y presentó investigaciones en conferencias internacionales como DEF CON y Black Hat. Además, descubrió vulnerabilidades en chips utilizados por Apple, Samsung y Motorola. También tuvo una fuerte participación en Ekoparty, donde presentó trabajos y preparó desafíos para enseñar seguridad informática. Colegas, amigos y alumnos lo recordaron como un mentor generoso y destacaron su disposición para compartir conocimientos. Los mensajes de despedida “Hay gente a la que 'grande' le queda chico, Andrés era de esos. Tenía un corazón abierto, con ganas de enseñar, acompañar y por sobre todo ayudarte a ser tu mejor versión” — Federico Kirschbaum. “Nuestra comunidad perdió un hacker con todas las letras, de los que la curiosidad y la capacidad hacen que quienes lo rodean crezcan y aprendan con él” — Ezequiel Gutesman. “Nos enseñaste a defendernos. Nos enseñaste puntualidad. Nos enseñaste a perder muchos miedos. Confiaste en nosotros y en lo que éramos capaces, tanto en lo personal como en lo profesional” — Joel Noguera y Florencia Ortelli. “Fue un gran mentor en lo profesional, un hacker puro y duro, hecho a los cachetazos, que supo dar charlas extremadamente técnicas en los mejores escenarios del mundo” — Lautaro “LeFF” Fain. (+) en Clarín: clar.in/4y4bJBu
76
133
13
1,683
404,050
You will be deeply missed, Andrés. We lost an incredible human being, a great hacker, and a friend. I will cherish your memory, and everything I learned from you. The stoicism lesson is a difficult one at the moment. Che la terra ti sia lieve, Andrés
Tengo la triste noticia que Andrés Blanco @6e726d falleció el día de hoy. Se nos fue un gran hacker, amigo y mentor. Memento mori solía decirme, Memento Mori. QEDP
2
3
18
2,736
If you were curious about the FreeRDP pre-auth RCE, @sam4k1 did an incredibile job in documenting the entire chain here
Check out @sam4k1's latest write-up: a technical deep dive on how three vulnerabilities we reported in FreeRDP can be used to achieve pre-auth RCE by popping a remote shell with some old school memory corruption shenanigans 🐧 bynar.io/blog/linux-has-scre…
1
4
718
Alfredo Pesoli retweeted
We're excited to welcome @pamoutaf to the research team! Watch this space 👀
1
1
7
3,170
Alfredo Pesoli retweeted
macOS 26.6.1 just patched a critical pre-auth root RCE in screensharingd that we disclosed 🚀
3
5
2
46
6,057
Alfredo Pesoli retweeted
Following our recent screensharingd disclosure, a separate pre-auth issue has also been highlighted; fortunately, it's also patched! You can find the technical details for our bug on our blog, essentially it uses the RFB Security Type 2 (VNC Authentication) which requires legacy VNC password access to be enabled. This in contrast to the pre-auth vulnerability which uses a separate authentication path, likely patched by one of the other screensharingd fixes in 26.6. As we've stated from day one, our vulnerability discovery and validation solutions at @bynar_io are autonomous. We use this capability to automate our internal research, at scale, on a variety of systems and targets, as a small team. Our goal is pretty simple: find genuine security issues and get them fixed. We're all passionate about security research, but as a small team, and with over 50 bugs in the queue that need to be reviewed and submitted, we don't always get to spend as much time as we'd like on each surface. Instead, once we've determined something's a genuine security issue, our priority is getting it fixed. It's certainly not a flawless approach, but it aligns with our mission and for us beats sitting on bugs while users remain vulnerable.
Sad, I had “this” bug for a long while. And even sadder is that they don’t understand or see the better bug LOl. The real bug is 10.0 score or close to it. There is no need for passwords or anything else, it’s full pre auth as long service is open ;-)
1
1
1
13
12,270
Alfredo Pesoli retweeted
Apple patched an incredible number of bugs in this July release (26.6). We like our CVEs served with a side of PoC, especially those that provide a shell and not just a crash. We believe this one is of particular interest because, well, it gives you a root remote shell on the latest Apple M5! That's right, a root remote command exec in macOS, in 2026?! Well, before anyone gets too excited: it's post-auth, and legacy VNC is disabled by default. But when it's enabled and you have the VNC password... root from remote 🤓 For some reason its description and severity were _slighty_ understated, but we demonstrate two bugs that lead to root RCE... No MIE/PAC bypass necessary, these are logic bugs. This is CVE-2026-43760, found by @__rev with Bynario Atlas and GPT 5.5. bynar.io/blog/a-root-remote-…
11
3
58
10,924
Alfredo Pesoli retweeted
My team is hiring! 🙌 Check out the link below for more details, feel free to ping me if you have any Qs :)
We're hiring a vulnerability researcher! If you're interested in working at the intersection of security research & AI, check out the role below or reach out to @sam4k1 if you have any questions. wellfound.com/jobs/4424689-v…
3
3
17
3,047
Alfredo Pesoli retweeted
Now that Canonical has fully patched CVE-2026-31694, we're sharing our code (along with a lil demo) for the FUSE LPE 🐧 Source @ github.com/BynarIO/pocs/tree…
7
30
2
104
12,724
Alfredo Pesoli retweeted
Discovery & Validation in the Linux Kernel Three-part article by @sam4k1 about analyzing two vulnerabilities (in CAN sockets and FUSE) and attempting to use local LLMs to rediscover the bugs. Final part: bynar.io/blog/discovery-vali…
13
51
4,697
We got curious about those kernel bugs we found last month and decided to test them on sub-70B local models (qwen/gemma). Same context the original model (Opus 4.6) that found the bug used and pointed them at the subsystems. Fancy graphs included.
1
2
968
Alfredo Pesoli retweeted
Here's the PoC for Nginx CVE-2026-42945 which works against vanilla Ubuntu (and any other distro?) + Nginx with ASLR enabled. I have included all iterations of the PoC the LLM was kicked to improve. TL;DR: We can use an LFI/file-read primitive to leak enough details from /proc/<nginx-worker>/mem to bypass ASLR and achieve reliable RCE, in most cases at first shot. There are still other ways to make it work, with even less subtle primitives. If you ask Geppetto nicely, he will help you ;) github.com/Hamid-K/nginx-rif…
5
91
5
331
40,654
Alfredo Pesoli retweeted
In the first of a three-part series, @sam4k1 does a technical deep dive on CVE-2026-31532: a race condition in the Linux kernel's SocketCAN subsystem discovered, validated, and patched by our pipeline. bynar.io/blog/discovery-vali…
15
2
48
15,349