Cybersecurity engineer, researcher, and advisor with broad technical and scientific experience on designing, analyzing, and testing security-critical systems.

San Diego, CA
Joined February 2008
The way #php2shell has been pre-announced is a glimpse of what the future of disclosure may be. Heads up to the public instead of embargoes, everyone rushes to find the same vuln, patches fly in, some will get exploited earlier. The best clankers will win the patching race.
3
1
1
536
Federico Maggi retweeted
🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST. Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using: 🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/31…) 🟧 Bambda scan checks (github.com/PortSwigger/bambd…) 🟧 BChecks (github.com/PortSwigger/bchec…) Start scanning for the vulnerability now → portswigger.net/bappstore/31…
11
262
17
1,242
74,069
Federico Maggi retweeted
Currently seeing 196.189.236[.]67 probing for the PHP vuns, suggest to block them on gateways, been hitting honeypots with a bunch of stuff since at least Oct 2.
4
31
1
159
17,686
Custom harnesses are still extremely valuable, despite frontier labs are pushing for bigger models that can one-shot complex cyber tasks. Confirmed by @unpromptedconf's analysis of 490 talks: "The work has moved from the model to the harness around it" unpromptedcon.org/wp-content…
Offensive AI Conference (OAIC) 2026 - @OffensiveAIcon My very unpolished takeaways straight out of day 2. trustial.substack.com/p/offe… ⬇️ Takeaways below ⬇️
1
6
431
Federico Maggi retweeted
The OAIC keynote video is live! Thank you to David Brumley for an excellent keynote, “AI Exploitation, Quantified,” and for giving us plenty to think about as frontier labs push AI’s cyber capabilities forward. Watch here: youtu.be/HY4_9o2xPvk
17
2
38
7,602
Federico Maggi retweeted
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success. I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉 If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter. It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately. Repo: github.com/nealbridges/VulnH… CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well. I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s Looking forward to developing on this further with the community.
31
220
9
1,562
104,299
- Vulnerability discovery in the age of AI is noise at industrial scale - Custom harnesses are still extremely valuable - Fine-grained benchmarking tells the true story and can inform RL efforts - ...
1
114
- ... - Models cheat routinely and see the sandbox as an obstacle to their goal - Don’t focus on the specific bug, focus on the class - We’re building safety and benchmarking platforms to enable red-teaming safe and measurable Kudos to the organizers. Amazing conference!
93
Offensive AI Conference (OAIC) 2026 - @OffensiveAIcon My very unpolished takeaways straight out of day 2. trustial.substack.com/p/offe… ⬇️ Takeaways below ⬇️
1
1
3
735
Federico Maggi retweeted
Oceanside is under a heat warning this week! As always, OAIC is casual- shorts and sandals are strongly encouraged! ☀️🩴
🤖 Made with AI
1
1
446
I must backpedal on this. I'm re-writing some of my decision-making agents and saving LOADS of tokens: - BEFORE: "reason on task X and create an answer that helps me decide on" - NOW: "Jev, is this A or B?" -> "Explain Jev's answer." Feeling bit dizzy but in awe!
Replying to @evilsocket
Linear regressions. Rewritten :)
1
2
239
It turns out that the second stage converges to an explanations much faster than w/o any prior leads.
55
Federico Maggi retweeted
The official IDA MCP is out. According to their blog, reduces token consumption by about 20% through an efficient architecture and works well with both frontier and local models. Link below.
The official IDA MCP Server is here. It's free, open source, and works with any LLM. Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time. 𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕 hex-rays.com/blog/hex-rays-i… (copy-paste: uvx ida-hcli mcp install)
3
28
1
210
20,264
This is the neatest tool I've seen in the last 6 months. I've tried a few: they either have a good user interface or a strong security/trust model. github.com/trailofbits/coop Amazing work by @trailofbits
14
66
2
669
50,087
I'm ultra-skeptical in trusting a VM, let alone trusting a non-VM sandbox. To those who commented about Lima/Firecracker: read and try coop :-) BTW, I just nudged Daybreak Red access to spawn `coop` VMs to work into and weeeeeee! 🚀 hope it wont break the VM itself 🤷‍♂️
2
406
I love this illustration. Ordering a print in 3…2…1 :-)
📡 New FuzzSociety masterclass: Baseband Exploitation Exploit a Samsung Exynos modem with FirmWire + AFL++ and reach arbitrary code execution. Browser-based Linux lab. No setup pain. 🎁 First 5 go FREE with coupon: ba§eband!!! fuzzsociety.org/product/base…
1
1
312
Skills are the new cgi-bin. Change my mind.
152