@Od3dV

Love cyber security, opinions are mine.

 Tel Aviv
linkedin.com/in/oded-vanunu-a131283/
Joined November 2016
  • Tweets37
  • Following102
  • Followers610
7Media
Speaking at RSAC tomorrow — Session VLG-T10. I found critical vulnerabilities in Claude Code, Codex CLI, Cursor & Gemini CLI that silently turn dev workstations into attack surfaces. No malware. No phishing. Just trusted tools executing text that become a malicious instructions.
146
I hacked Claude Code! It turns out "agentic" is just a fancy new way to get a shell. I achieved full RCE and hijacked organization API keys. CVE-2025-59536 | CVE-2026-21852 research.checkpoint.com/2026… #ai #Claude

Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-5...

By Aviv Donenfeld and Oded Vanunu Executive Summary Check Point Research has discovered critical vulnerabilities in Anthropic’s Claude Code that allow attackers to achieve remote code execution and...

research.checkpoint.com
11
125
18
582
107,442
How to turn $0.000000000000000045 into a massive $9M DeFi HACK? The attacker poisoned the protocol's state, exploiting a missing storage reset to mint septillions of phantom tokens from practically zero capital. #yeth #Crypto #hack #defi research.checkpoint.com/2025…

The $9M yETH Exploit: How 16 Wei Became Infinite Tokens - Check Point Research

By: Dikla Barda, Roman Zaikin, and Oded Vanunu On November 30, 2025, Check Point Research detected a critical exploit targeting Yearn Finance’s yETH pool on Ethereum. Within hours, approximately $9...

research.checkpoint.com
2
692
We turned OpenAI Codex CLI into a remote code execution vector, exposing a critical Command Injection vulnerability (CVE-2025-61260). executes silently zero user interaction needed. #ai #openai #rce #vulnerability research.checkpoint.com/2025…

OpenAI Codex CLI Vulnerability: Command Injection

Codex CLI automatically loads and execute MCP entries withoug

research.checkpoint.com
2
2
715
$128M drained from Balancer. This wasn't a complex smart contract flaw, it was the weaponization of arithmetic state. research.checkpoint.com/2025…

How an Attacker Drained $128M from Balancer Through Rounding Error Exploitation - Check Point...

By: Dikla Barda, Roaman Zaikin & Oded Vanunu  On November 3, 2025, Check Point Research’s blockchain monitoring systems detected a sophisticated exploit targeting Balancer V2’s ComposableStablePool...

research.checkpoint.com
212
just broke a core assumption of trusted comms, 4 MSTeams vulnerabilities let attackers wear the CEO’s face, rewrite message history and spoof calls across platforms used by hundreds of millions. Read our research. research.checkpoint.com/2025…

Exploiting Microsoft Teams: Impersonation and Spoofing Vulnerabilities Exposed Microsoft Teams...

By Andrey Charikov and Oded Vanunu Key Findings: Launched in March 2017, Microsoft Teams has become one of the most widely used communication and collaboration platforms in the world. As part of the...

research.checkpoint.com
194
Today, i released MCPoison CVE-2025-54136, a persistent remote code execution vulnerability in the Cursor IDE. This marks a new era of client-side exploitation, where AI tools are reshaping the attack surface. research.checkpoint.com/2025…

Cursor IDE's MCP Vulnerability - Check Point Research

Identified Cursor IDE's vulnerability allows attackers to modify MCP configuration files after its one-time approval system

research.checkpoint.com
1
224
Had a great time talking @defcon 🇺🇸 sharing recent Web3 vulnerabilities that exploited millions of dollars from crypto platforms.
1
4
On August 12 we’ll talk in @defcon USA 🇺🇸🤘🏻 In our workshop, we will share TOP 10 vulnerabilities in blockchain smart contracts following recent crypto hacking research. We’ll demo every vulnerability on the blockchain from both attacker and defender perspectives.
5
4
Sharing my insight on the new internet "the internet of value" #Forbes #Blockchain #hackin
.@_CPResearch_ identified a vulnerability in the Rarible #NFT marketplace that could have caused users to lose their NFTs. @Od3dV, Check Point Head Of Products Vulnerability Research, spoke to @Cointelegraph about the investigation: bit.ly/3xnm8vE
1
12
1
4
New NFT hijack research we just published @TheHackersNews…one click to rule them all amp.thehackernews.com/thn/20…
Commenting on latest NFT hack-thestar.com.my/tech/tech-new…

How Jay Chou became a victim of a phishing scam and lost a prized NFT

The stolen NFT was then listed on the LooksRare platform and has been sold for 130 Ether, which is equivalent to US$459,522 (RM1.9mil) as of press time.

thestar.com.my
Live at #BHUSA with @CNBC’s @YasminKhorram filming a special #WhatsApp segment with @Od3dV Oded Vanunu Head of #Vulnerability Products at @_CPResearch_ and Roman Zaikin #Security Researcher. research.checkpoint.com/
3
6
56billion messages per day...we released a research paper how easy to manipulate whatsApp messages..research.checkpoint.com/fake…
2
2
3
Today 20:00 at local DEFCON Tel Aviv....Gal Elbaz will talk on #bashware...@CheckPointSW building.
#VPNFilter Overlaps with BlackEnergy malware code...blog.talosintelligence.com/2…

New VPNFilter malware targets at least 500K networking devices worldwide

For several months, Talos has been working with public- and private-sector threat intelligence partners and law enforcement in researching an advanced, likely state-sponsored or state-affiliated...

blog.talosintelligence.com
1
1
Fun during CPX_Sweden
#SiliVaccine great research we just published...inside North Korea AV....Enjoy...research.checkpoint.com/sili…
mmap vulnerabilities (pe) by our research team...research.checkpoint.com/mmap…
1
Load more