Windows Security Researcher 😉
Joined April 2022
- Tweets31
- Following111
- Followers74
- Likes81
nevul37 retweeted
Excited to share our new paper, SEC-bench Pro! Can AI agents actually find impactful vulnerabilities?
We built a benchmark of 344 reproducible bugs in V8, SpiderMonkey, and the Linux kernel, then put 6 frontier models to work. Our best agent solves 58%. 🧵
nevul37 retweeted
Update to the Windows Insider Preview bounty program: General Awards for Elevation of Privilege and Information Disclosure are now split by finishing privilege, with award ranges increasing to $1,000–$8,000.
This change is designed to better align rewards with the impact of reported vulnerabilities.
Learn more on the Windows Insider Preview bounty page: msft.it/6018v3QZI
ALT Windows Insider Preview Bounty Update
nevul37 retweeted
We’re happy to release 𝐒𝐄𝐂-𝐛𝐞𝐧𝐜𝐡 𝐏𝐫𝐨: a benchmark for measuring the bug-hunting capabilities of AI agents in critical software systems such as Chromium V8, Firefox SpiderMonkey, and more.
Explore the details here: sec-bench.github.io
nevul37 retweeted
[1/2]
CVE-2026-32223: heap overflow in usbprint.sys (IOCTL 0x220064).
Malformed USB descriptor, Named Pipe spray + Ghost Chunk for kernel leak, forged IRP, SYSTEM.
Writeup: enki.co.kr/en/media-center/b…
#CVE_2026_32223 #WindowsKernel #LPE #vulnresearch
nevul37 retweeted
We recently achieved guest-to-host escape by exploiting a QEMU 0day.
We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.
Writeup coming next week.
nevul37 retweeted
🤯🤯🤯 Gemini 3 Pro + Live-SWE-agent hits 77.4% on SWE-bench Verified, beating ALL existing models, including Claude 4.5!!
🤖 Live-SWE-agent is the first live software agent that autonomously self-evolves on the fly — and it even outperforms the manually engineered scaffold used by the Gemini 3 Pro team (76.2%)
nevul37 retweeted
Ever wanted to debug the secure kernel but couldn't figure out how? Me too. It's awful.
But I eventually got it working and managed to do some cool stuff, so I documented my solutions here in case it helps anyone else: windows-internals.com/secure…
nevul37 retweeted
How to reach the CTF finals
Other CTFs: study hard and grind to capture the flag
@Blackhatmea CTF: just trade flags 🥵☠️☠️☠️
nevul37 retweeted
Here is the PoC of the exploit for cve-2025-30712 as well as some of the code for the fuzzer i created to find the bug!
github.com/google/security-r…
nevul37 retweeted
Whoah... $250000
(CVE-2025-4609, similar to CVE-2025-2783/412578726)[412578726][Mojo][IpczDriver]ipcz bug -> renderer duplicate browser process handle -> escape sbx is now open with PoC & exploit(success rate is nearly 70%-80%)
issues.chromium.org/issues/4…
issues.chromium.org/issues/4…
(CVE-2025-4609)[412578726][Mojo][IpczDriver]Incorrect handle provided in unspecified circumstances
chromium-review.googlesource…
Reported by Micky on 2025-04-22
nevul37 retweeted
Here are the links to the recordings of my prior two webinars:
Debug of Hyper-V, Secure Kernel, VBS Enclaves, Defender, and other secrets: attendee.gotowebinar.com/rec…
and Advanced Threat Analysis and Reverse Engineering using AI: attendee.gotowebinar.com/rec…
nevul37 retweeted
Windows Inter Process Communication – A Deep Dive Beyond the Surface, by @haider_kabibo
Part 1 sud0ru.ghost.io/windows-inte…
Part 2 sud0ru.ghost.io/windows-inte…
Part 3 sud0ru.ghost.io/windows-inte…
Part 4 sud0ru.ghost.io/windows-inte…
Part 5 sud0ru.ghost.io/windows-inte…
My ranking changed from 26th to 22nd with 662.5 points earned over the past year.
I placed 8th in the Windows category, collaborating with @develacker on the SEC-agent team.
Thanks to @msftsecresponse for the update, and to @ENKI_official_X for the support.
Our previously published Most Valuable Researchers (MVR) leaderboard contained inaccuracies due to technical issues on our end. We apologize for the error and have since resolved the issue. We’re now sharing a fully refreshed and accurate leaderboard.
The Microsoft Researcher Recognition Program offers public thanks and recognition to security researchers who help protect our customers by discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure.
We are excited to recognize this year’s Most Valuable Researchers (MVRs), based on the total number of points earned for each valid report. Please join us in celebrating this year’s MVRs, including our top 10:
1. 🥇wkai
2. 🥈VictorV (@vv474172261)
3. 🥉Suresh Chelladurai
4. Anonymous
5. Brad Schlintz (@nmdhkr )
6. @0x140ce
7. Anonymous
8. Dhiral Patel (@dhiralpatel94)
9. Nan Wang (@eternalsakura13) and Ziling Chen
10. Adnan (@adnanthekhan)
See the full list of this year’s MVRs, in addition to our Azure, Office, Windows, and Dynamics 365 leaderboards: msft.it/6019sBjyU
#bugbounty
ALT MVR
nevul37 retweeted
Congratulations to all the researchers named to this year’s Most Valuable Researchers (MVR) list, including: @vv474172261 @adnanthekhan @dhiralpatel94 @eternalsakura13 @0x140ce @4zure9 @KeyZ3r0 @nmdhkr @edwardzpeng @haifeili @thezdi @nevul37 @Xtytia0922 @scwuaptx @the1bernard @wh1tc @ycdxsb @Panther82Black @sim0nsecurity @Fatnass1F1ras @shhnjk @yuvalavra @crispr_x @scianto05 @niraj1mahajan @filip_dragovic @nvk0x @ashketchum_16 @guilhermesgi @c0d3nh4ck
🔥🔥🔥
Congratulations to all the researchers recognized in this quarter’s MSRC 2025 Q2 Security Researcher Leaderboard! Thanks to all the researchers who partnered with us for your hard work and continued dedication to securing our customers.
Learn more in our blog post: msrc.microsoft.com/blog/2025…
We also want to recognize the top 10 researchers in the leaderboard:
🥇wkai
🥈Brad Schlintz (@nmdhkr)
🥉@0x140ce
🥉 Zhiniang Peng (@edwardzpeng) with HUST & R4nger (@R4nger99) with CyberKunLun
5. VictorV (@vv474172261)
6. k0shl (@KeyZ3r0)
7. @wh1tc @ Kunlun lab& devoke & Zhiniang Peng (@edwardzpeng) with HUST
8. Jongseong Kim (@nevul37), SEC-agent team
9. Anonymous
10. Haifei Li (@HaifeiLi)
10. Nick Wojciechowski
ALT MSRC Q2 Leaderboard
nevul37 retweeted
Enki WhiteHat has detected activity where Kimsuky abuses GitHub as attack infrastructure.
Private GitHub repositories are accessed using PATs, leading to XenoRAT deployment.
See the full attack flow and the details of how Kimsuky approaches its victims:
enki.co.kr/en/media-center/t…
#APT #Kimsuky
nevul37 retweeted
Oh hey! That’s my bug 👀
youtu.be/3HfJj5S_tbk
