Security Consultant @semperistech . Independent Security Researcher. Cyclist & Scubadiver. MSRC MVR 2022. "So di non sapere"

Joined May 2009
In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”. But was it really fixed? Ask @tiraniddo projectzero.google/2026/09/w…
3
46
2
213
17,220
Been digging deep into the Windows Endpoint Security Platform (WESP) in Win11 25H2, definitely one of the most fascinating security features Microsoft has built in a while. The concept is neat: compile rules to decision graphs in user mode, hand them to wesp.sys, and let the kernel evaluate them in-path while telemetry streams asynchronously in the background. I did an AI-assisted reverse engineering dive into the whole stack (wesp.sys, espclient.dll, and wesp_elam.sys), documented the wire protocols, disposition tables, and the enforcement gate, and built esptool, a research harness with 118 XML rule docs so anyone can test live telemetry and in-kernel blocking. Repo: github.com/marcosd4h/wesp_re… Tech doc: github.com/marcosd4h/wesp-re… Thanks to @yarden_shafir for putting this on my radar
1
61
1
183
13,595
Andrea P retweeted
A new O'Reilly bestseller!
179
1,037
122
8,138
362,741
Regarding Active Directory permissions, most people assume that a Deny ACE always wins. It doesn't! Windows stops the access check the moment enough rights are granted — any ACE after that point is never evaluated. New post: managedpriv.com/blog/acl-can…
1
7
19
1,693
Andrea P retweeted
Replying to @4ndr3w6S
@4ndr3w6S pulled me into this rabbit hole, and it was a fun one.
2
3
1,318
Andrea P retweeted
This second blogpost concludes @yaumn_'s research on #Windows authentication reflection. He discloses the new Kerberos authentication coercion technique he discovered to remotely compromise Windows systems 💥 A little bonus is even included at the end 👀👇 synacktiv.com/en/publication…
2
56
2
124
12,163
Andrea P retweeted
Questo è bellissimo. Ma, e se fosse vero? – at Casale Monferrato, Piemonte
31
160
17
1,218
59,240
DREAMS DO COME TRUE ❤️
15
345
16
4,992
53,621
Andrea P retweeted
[RELEASE] Better late than never! Part 3 is out! Fantastic unwind information and where to find them. We went digging through .pdata, RTF Lookups, and a few ntdll internals that probably weren't meant to be touched. BYOUD dropping alongside. Enjoy 😉 klezvirus.github.io/posts/By…
2
54
175
14,315
Replying to @decoder_it
@decoder_it breaks down reflection attacks and their impact on enterprise security in this new talk at #INSO26. Are you interested in how modern authentication flow works? So this talk is for you! Save your spot: ow.ly/cCr450Ykak4 #Infosec #INSO26 #CyberConference
4
6
1,238
In the final part of his blog series, @tiraniddo tells the story of how a bug was introduced into a Windows API. Code re-writes can improve security, but it’s important not to forget the security properties the code needs to enforce in the process. projectzero.google/2026/02/g…
54
1
190
21,549
I’ve been a developer for 10 years. I’ve mastered languages. I’ve optimized databases. I’ve built systems that handle millions of requests. But last week, a Junior dev outperformed me. He didn’t know how to write a complex program. He couldn’t explain the difference between a proper monoloth and a microservice. He didn't even know how the code worked in some parts. But he knew how to talk to the Agents. He orchestrated three AI workers. One for the frontend. One for the backend logic. One for the unit tests. In 4 hours, he pushed a feature that would have taken me 3 days. I felt a cold shiver. "Is this it?" I thought. "Am I finally the legacy hardware?" But then I looked at his PR. It was fast. It was functional. But it was… fragile. It lacked architectural vision. It had security holes that only someone who has been "burned" would see. It was a house built on sand. That’s when I realized the truth about 2026. The "Senior" title isn't about how fast you type anymore. It's about how well you judge. We are moving from being "builders" to being "architects." From "coders" to "composers." If you’re a veteran feeling left behind by AI: Don’t compete on speed. Compete on wisdom. The machine can write the notes. Only you can write the symphony.
476
638
104
5,596
377,725
Andrea P retweeted
[RELEASE] As promised, I’m releasing the first blog post in a series. It covers the gaps still present in current stack-based telemetry and how Moonwalking can be extended to evade detection logic and reach “on-exec” memory encryption. Enjoy ;) klezvirus.github.io/posts/Mo…
8
111
2
337
28,940
Tourism Minister Daniela Santanchè posts an article by @annabelmaud from The Telegraph and suggests that a family moved to Italy to live a better life. Too bad the full article says something completely different. The post has been removed. Nov 8, 2025
54
304
53
1,981
231,221
Italians still keep moving away from Italy. That’s one reason why youth unemployment improved over the last decade (there are just no young Italians left to be unemployed). Germany remains the top destination. HT @maps_interlude
196
829
173
3,098
373,317
Andrea P retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
138
899
112
3,174
481,587