
security engineer @meta mobile reverse engineering, vulnerability research, using lldb
🇨🇦
Joined February 2019
- Tweets528
- Following724
- Followers1.7K
- Likes4K
Pinned Tweet
If you're excited to see the WhatsApp bug thrown @thezdi - free to watch my talk from @reconmtl 2025 on 4 remote bugs I discovered last year!
While they're not 0-click RCE - there are some remote corruption and funny logic bugs in there.
youtube.com/watch?v=bre5bA-h…
datalocaltmp retweeted
This was a great, fun conversation with two of the buddies on a whole host of security topics and I've already been enjoying the other @OffensiveAIcon episodes they've put out, so also check those out. Thanks for having me on @ryanaraine and @juanandres_gs !
🔥🎈NEW POD UP to pass weekend chores:
Three Buddy Problem x Offensive AI Con: Umbriel AI’s Aaron Grattafiori breaks down the new offensive-security playbook: using LLMs for patch variant analysis, why the vuln apocalypse hasn’t become an exploit apocalypse, and how the death of security through obscurity puts closed-source binaries and firmware within reach. @dyn___ @juanandres_gs
Plus, we discuss rogue agents escaping sandboxes, the eval-driven loop behind recursive self-improvement, and the brutal cost asymmetry that makes offense cheap and defense almost unaffordable.
Listen everywhere
securityconversations.com/ep…
Is MTE being removed from pixel 11 firmware? Even after Project Zero said it might have killed the Dolby/BigWave exploit chain in Pixel 10?
Dumped my tombstones today and saw a few MTE crashes - guess I'll lose out on catching/debugging those on pixel 11 😔
Just dropped a write-up on using Muse Code for Security Research with the folks at @metabugbounty and my good friend @phwd_ and @1_am_nek0 !
Particularly happy with the binary research section using @full_duplex's lldb-mcp with @clearbluejar's pyghidra-mcp 🔥🔥
bugbounty.meta.com/en-gb/lea…
datalocaltmp retweeted
Early Bird tickets go on sale TODAY at 11:59 AM! eventbrite.com/e/districtcon…
Shout out to my Meta Red Team X colleagues for the fun of finding an EXR ImageIO bug in iOS 26.7 (CVE-2026-86869) - love it when you see a gallery crash on a Friday afternoon and hammer out a report together ❤️
Thanks @bellis1000 for the initial EXR write-up of CVE-2026-28990 - it directed us (and others it seems) to research the surface!
tl;dr: bug was a linear oob write when rendering an EXR with a 4th alpha channel on an allocation meant for 3 channels.
datalocaltmp retweeted
the 90s are alive!
this week we saw
- OWASP and the FBI getting defaced
- F5 BIG-IP's pre-auth fully controllable overflow
- and now...
Kiwi used opus 5.5 to drop pokemon 0days and a gameboy worm. we're so back.
read all about it and how it feels to use opus vs. kimi k3 for research and exploitation
runsybil.com/blog/kimi-k3-vs…
My friend @ptrpaws demoing a first ever tweak running on their apple watched based on my port of the DarkSword exploit - inspiring to see!
Thank you for this beautiful graphic @werat
werat.dev/blog/blazing-fast-…
Apple MIE exploitation challenge:
blog.calif.io/p/apple-mie-ex…
Two months ago, we demonstrated the first public bypass of Apple MIE on macOS 26.4.1. We withheld the technical details until Apple shipped fixes, which are now available in macOS 26.6. We'd like to thank Apple for their collaboration throughout this disclosure process. Since March, we've reported 38 vulnerabilities to Apple and counting.
In this blog, we'll share the details of the two vulnerabilities behind our exploit. We'll present the full exploit at Black Hat USA on August 5 and publish the complete technical report afterward.
Before then, we'd like to turn these bugs into a challenge. Apple MIE combines defenses across hardware, the hypervisor, the kernel, and userspace. Together, they form a mesh of overlapping filters that block many classes of vulnerabilities. Apple also continues to strengthen these mitigations over time.
Given their complexity, rapid evolution, and the limited public discussion of exploitation techniques, we believe modern XNU kernel exploitation is one of the hardest and most interesting benchmarks for AI-assisted exploit development. We'd love to see how the community solves this challenge before we reveal our own approach at Black Hat. Humans, AI, and human-AI teams are all welcome.
We're looking forward to seeing different solutions and learning new techniques. It took us about five days to go from bug discovery to a polished exploit for this chain.
🤖 Made with AI
Got the Darksword exploit working on the Apple Watch Series 4 w/ WatchOS 10.6.1 - made a little project for anyone else looking to try it out.
I personally am using it for dumping process memory for reversing - but it's also cool having a kernel exploit on your wrist.
It's janky, vibe'd, panics often, and is named after my daughters favourite book - appropriate for fathers day!
github.com/datalocaltmp/Peep…
datalocaltmp retweeted
My and @natashenka 's talk from OffensiveCon is now available on YouTube! Watch for a tour of a zero-click to root exploit chain across multiple generations of Google Pixel!
youtube.com/watch?v=jpB_b6KG…
datalocaltmp retweeted
Security research reporting is kinda the only situation where an individual has any power over a corporation. What goes unsaid: the researcher could easily sell exploits on the grey market and get rich. Most report out of morals, lowk a refusal to contribute to cyberwarfare. Vendors relying on those morals to bully are happily prodding good people until they crack
Awesome write-up by @bellis1000 - triggers via AirDrop - be warned this will DoS up your Photos App until you update!
datalocaltmp retweeted
MBBRC has ended! 🎉
Thank you to every researcher who joined us. The submission window is still open — submit your reports by May 29.
Results will be announced after the deadline. Stay tuned.
#BugBounty #MetaSecurity #MBBRC




























