0-day monkey | IBM X-Force Offensive Research (XOR)
Stuck in Vim
Joined May 2025
- Tweets43
- Following191
- Followers935
- Likes778
dinosaurlover38 retweeted
People often ask me how I think about fuzzers and other tooling in the age of AI. Instead of my opinion, here is some hard data by @5aelo.
LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer.
projectzero.google/2026/10/f…
Shoutout to OAIC, an amazing conference run by amazing people! The world's most cursed (but sick) fuzzer coming up next month!
New talk up OAIC 2026: Vibe Fuzzing with Sam Lovejoy @_dinolover38 of IBM X-Force Offensive Research.
Sam explores how graph-based inputs, program state, and LLM guidance come together in an AI-guided fuzzing engine- and the tradeoffs behind it.
Watch the full talk: offensiveaicon.com/vibe-fuzz…
#OAIC #OffensiveAI #Fuzzing
+1 rep for Evilmog, truly the greatest late-career vuln research intern to ever do it
you will be missed ❤️
dinosaurlover38 retweeted
OAIC's CFP is now open!
The first conference dedicated to the cutting edge of the offensive use of AI is returning for its second year. Speakers will enjoy three nights at a four-star beachfront resort, which includes all meals and drinks, three exclusive parties, and a Michelin-star welcome dinner.
Please see sessionize.com/offensive-ai-… for accepted topics.
dinosaurlover38 retweeted
We’ve now seen at least four nginx RCEs that require non-default configs: nginx rift, nginx poolslip, and two of our own (including the one in the last tweet).
The configs involved are unusual, which raises the obvious question: do these attacks actually work in real-world deployments?
We asked Claude to download and analyze more than 4,000 nginx config files from GitHub.
The result was embarrassing: none of them were vulnerable to nginx rift or our own attacks. We can’t say anything about nginx poolslip yet, since it hasn’t been published.
So don't worry about your nginx yet.
Moral of the story: AI can generate FUD, but also help fight FUD. Embrace it!
dinosaurlover38 retweeted
Boom! @chompie1337 wastes no time kicking off #Pwn2Own Berlin in style. She requires just a few second to get code execution on the NV Container Toolkit. She heads off to the disclosure room to provide all the details.
The double free in httpd is the same way, but the underlying vulnerability is powerful enough to RCE. Exploit dev is hard and AI won't do it for you (yet)
Except that this httpd pre-auth “RCE” exploit does not work. A real exploit requires an infoleak, and the author conveniently supplied a “helper” that reads addresses directly from /proc/<pid>/mem.
We also found this bug in early April, submitted it, and were told it's a dup. Then we burned to develop an exploit, to no avail. Need an infoleak.
It's interesting that AI struggles exactly where humans struggle too.
Great read! My experience with pipe buffers is they're really great for PoC kCTF style exploits, but mediocre on noisy systems bc of rlimits
My new article: "Some notes on the security properties of the pipe_buffer kernel object"
Many Linux kernel exploits use the pipe_buffer kernel object to build strong exploit primitives. I experimented with pipe_buffers and discovered something interesting a13xp0p0v.tech/2026/04/20/pi…
OSS-Fuzz found this 18 yr old remote integer underflow in nginx. I found it too, but 2 weeks slower.
Google's CodeMender AI submitted the exact same fix as me.
Just look how similar our reports are.
Security research might just be cooked.
issues.oss-fuzz.com/issues/4…
I know the universe owes me nothing but it'd be really cool if I got some nginx 0-days for getting 2x more code coverage compared to OSS-fuzz just saying
Experience the joy of race conditions in the comfort of your own home!
Watch XOR’s talk CUDA de Grâce: Owning AI Cloud Infrastructure with GPU exploits
Kernel + driver bugs aren’t just a LPE problem, they’re a cloud problem. With the explosion of AI in the cloud, NVIDIA’s GPU drivers have become a valuable attack surface
youtu.be/Lvz2_ZHj3lo
dinosaurlover38 retweeted
Any Canadian friends with strong red team backgrounds looking for an AdvSim spot?
ibmglobal.avature.net/en_US/…
You can also use this same idea to defeat CONFIG_SLAB_VIRTUAL, even if a kernel PTE has been assigned; the memory still has another VMA from the fixed phys/virt relationship
We did this in our exploit for CVE-2025-23282 (public soon🤞)
We really should be talking about this more....KASLR is just not working properly on Android right now, and it hasn't for a long time.
googleprojectzero.blogspot.c…
huge if true
🚨 NEW DINOSAUR DROPPED 🚨
npr.org/2025/10/30/nx-s1-558…
dinosaurlover38 retweeted
Last month, @d_tranman and I gave a talk @MCTTP_Con called "COM to the Darkside" focusing on COM/DCOM cross-session and fileless lateral movement tradecraft.
Check out the slides here: github.com/bohops/COM-to-the…
Recording should be released soon.
dinosaurlover38 retweeted
en 5 minutos, en vivo!! entrevista en español con yo @_dinolover38 youtube.com/live/RdihQH7uuss
dinosaurlover38 retweeted
tfw a tweetable PoC can take down yr cloud compute
CVE-2025-23282 is going to debut tomorrow at @hexacon_fr in our talk "CUDA de Grâce" w/ @chompie1337, but you can try CVE-2025-23332 now!
Tweetable Python PoC:
```
import fcntl
fcntl.ioctl(open('/dev/nvidiactl'),218,0)
```
CVE-2025-23282 is going to debut tomorrow at @hexacon_fr in our talk "CUDA de Grâce" w/ @chompie1337, but you can try CVE-2025-23332 now!
Tweetable Python PoC:
```
import fcntl
fcntl.ioctl(open('/dev/nvidiactl'),218,0)
```
NVIDIA has released a security bulletin for NVIDIA GPU Display Drivers.
NVIDIA thanks Daniel Rhea, Sam Lovejoy, Valentina Palmiotti, Robin Bastide, JunDong Xie, Giovanni Di Santi, Andrea Di Dio, and Cristiano Giuffrida for reporting their findings.
nvidia.com/en-us/security/