🌐 Security Researcher | 🤖 AI Enthusiast | 🎙️ BlackHat ASIA/EU/USA. 𝕏s are my own.
Joined November 2018
- Tweets65
- Following431
- Followers860
- Likes424
P1umer retweeted
A few years ago I had a weird thought: does ETH have a theoretical price ceiling?
It came from living through the FOMO cycles — USDC depeg, BSC mania — and watching L2s explode. Gas got so expensive I started wondering: is ETH's price actually capped by its own gas fees?
I could only test it properly recently, with Claude. here's what I found
P1umer retweeted
I've uploaded the slides of my recent talk "JS Engine Security in 2025": saelo.github.io/presentation…. I think there'll also be a recording available at some point (otherwise I can make one as not everything's in the slides).
Thanks for the fantastic conference @POC_Crew!
P1umer retweeted
🔎 How do sink-aware fuzzing + LLMs uncover Java vulns under pressure? See how Atlantis-Java did it.
👉 team-atlanta.github.io/blog/…
#AIxCC #Cybersecurity #CTF #AI #LLM #GenAI #AICyberChallenge #DARPA #DEFCON #Security #Vulnerability
P1umer retweeted
icymi: CodeQL can now scan C/C++ without needing to build 🙌 github.blog/changelog/2025-0…
P1umer retweeted
New blog out now! We’re answering the top questions from the DEFCON audience and sharing the behind-the-scenes story of our victory. team-atlanta.github.io/blog/… #AIxCC
P1umer retweeted
"AI Agents for Offsec with Zero False Positives" by @moyix, a journey on how we managed to get 0 FPs with XBOW. You can find the slides for his BH talk here: cdn.prod.website-files.com/6…
P1umer retweeted
Today, we announced the official release of OSV-SCALIBR, Google's software composition analysis library. If you are working in vuln management / security scanning, SCALIBR is for you! SCALIBR is powering most of Google's vuln scanning. Please RT
security.googleblog.com/2025…
P1umer retweeted
Our slides about WASM bugs in browsers are now available.
Thanks to everyone who helped with the talk.🫡
Hope we can do better next time.
1. BH USA 2024: i.blackhat.com/BH-US-24/Pres…
2. GeekCon Shanghai 2024: geekcon.top/js/pdfjs/web/vie…
cc my partners (@p1umer @xmzyshypnc1 @q1iqF)
P1umer retweeted
During #BHUSA Briefing "Achilles' Heel of JS Engines: Exploiting Modern Browsers During WASM Execution" we will discuss some of the interesting vulnerabilities we found on attack surface of WebAssembly and demonstrate how to exploit them >> bit.ly/3yXSpfD
P1umer retweeted
Thanks to events like Pwn2Own or our V8CTF (~= exploit bounty program), we now have more data about the types of bugs exploited in V8. Based on that, we've gathered some basic statistics: docs.google.com/document/d/1…
P1umer retweeted
Thanks to the fine folks at @nautilusinstitute the #defcon32 #ctf quals are in the books - you can read all about it at quals.2024.nautilus.institut…. There's also a veritable feast of JSON dumps for the curious. Congrats to the winners, thank you to everyone who suited up and we'll see you in Las Vegas!
#defcon
P1umer retweeted
A short but happy trip at Blackhat Aisa 2024.
Our slide is available now: i.blackhat.com/Asia-24/Prese…
Hope you like it and hope we can do it better next time.
Thanks to everyone who helped with this talk.
And also thanks @darkfloyd1014 's gifts, I like them so much.
P1umer retweeted
(CVE-2024-2606)[1879237]Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into pointer values.
hg.mozilla.org/mozilla-centr…
@p1umer
P1umer retweeted
Had a good time at Blackhat Europe 2023.
The release version of our slide is available now: i.blackhat.com/EU-23/Present…
Hope you like it.
Thanks to everyone who helped with this talk!!🥳🥳
P1umer retweeted
Blogpost from me and @tunneleffext ! microsoftedge.github.io/edge…
P1umer retweeted
CVE-2023-20593 — Exploiting Zenbleed from Chrome
This repository contains a proof-of-concept for exploiting Zenbleed from Chrome using a V8 vulnerability which enbles arbitrary code execution in the renderer process.
github.com/vu-ls/Zenbleed-Ch…
Details:
vu.ls/blog/exploiting-zenble…
#cybersecurity #pentesting #redteam #bugbounty
P1umer retweeted
Sharing another V8 Sandbox design document more widely: docs.google.com/document/d/1…
This one discusses how to protect code pointers - probably the most performance sensitive part touched by the sandbox - with (almost) no performance overhead.
P1umer retweeted
Following several evaluations in which we used binary-only fuzzing, we wrote a hands-on blogpost about our step-by-step approach to setup grammar-aware in-memory persistent fuzzing campaigns using AFL++-QEMU. Check it out here: airbus-seclab.github.io/AFLp…!
