kmkz (@kmkz_security) header
kmkz (@kmkz_security) profile picture

Bourbon Offensive Security Services | BOSS

Troisvierges, Luxembourg
Joined October 2012
-> Let's do it ! 🔥 boffsec-services.com/trainin… – at Troisvierges, Luxembourg
AI won't replace offensive security, but it's changing what we can achieve during real engagements. I'm considering a 2-day advanced hands-on training on Augmented Pentesting, sharing how I use LLMs for n-day research and exploitation. Not perfect, but tested and proven during real-world engagements. The question is: Would you be interested? ------------- 🇫🇷 L'IA ne remplacera pas la sécurité offensive, mais elle change déjà ce que nous pouvons accomplir lors de nos missions. J'envisage de proposer une formation technique avancée de 2 jours sur le Pentest Augmenté, pour partager la manière dont j'utilise les LLM dans la recherche et l'exploitation de vulnérabilités n-day. Une approche qui n'est pas parfaite, mais qui a été testée et éprouvée lors de missions réelles. La question est donc : est-ce que ça vous intéresserait ?
5
1
28
3,051
Welcome to Hotel Calif, where Brotli might lead to memory corruption. But who would use wifi with a phone in lockdown mode 😜
Welcome to Hotel Calif. We're in lockdown mode. You can check in, but you can never leave. Broccoli is served around the clock. The Brotli bug apparently affected iOS and macOS too. Apple released version 27.2.1 yesterday, fixing this bug among other security issues. This is an important security update. If you haven't updated yet, now's a good time. The demos show what we were able to do with it.
4
10
146
12,905
kmkz retweeted
We're looking for a Senior Manager, Endpoint Protections at Elastic (100% remote): - deep endpoint OS internal knowledge - experience developing EDR capabilities - adversarial instinct - Bonus points for endpoint AI/ML experience jobs.elastic.co/jobs/enginee…
4
20
69
8,454
🔓 Breaking the Sandbox: PHP disable_functions Bypass via Use-After-Free (8.5.x / 8.4.x) Today, ZeroZenX disclosed a Use-After-Free vulnerability in PHP 8.5.x / 8.4.x that allows escaping disable_functions and achieving OS command execution. Our clients are already protected. Full technical writeup and PoC on GitHub 👇 github.com/zerozenxlabs/PHP-… #PHP #AppSec #VulnerabilityResearch #ZeroZenX #bugbounty #zeroday
1
21
2
99
8,933
Besides fuzzing, researchers also find vulnerabilities by serendipity, just by tinkering with systems. I found and documented one of those cases here: Accidentally Uncovering A Seven Years Old Vulnerability In The Linux Kernel
allelesecurity.com/vuln-tcp-… I also have a pending blog post about another vulnerability I found the same way. And those two cases aren't the only ones I have found by serendipity. Here is another case, by someone else: The code that wasn't there: Reading memory on an Android device by accident
github.blog/security/vulnera… Those who tinker with systems are the most likely to come across these issues. Playing directly and manually with them might still be worth it for several reasons: it's fun, it keeps you fresh, and it might lead to unexpected results that wouldn't be found through reasoning alone.
6
21
87
3,328
Verify it, close it, read it again? Bro,that's TOCTOU. EDR vendors :)) Reported it. Blog coming if accepted.
3
3
59
4,110
New exploits in the @VulnCheckAI Initial Access community repo: Atlassian Data Center unauth cred leak (CVE-2026-21589), GitLab unauth RCE (CVE-2026-97229), and a Collabora Online RCE used in ransomware attacks (CVE-2026-110447). Detections + queries, too: github.com/vulncheck-oss/ini…
3
10
1
35
1,972
The final part of our CVE-2023-20938 series: turning a Binder use-after-free into root on a Pixel 6 running Android 12. Root turns out to be anticlimactic: a few fields in one kernel struct, set to zero. 🔗 Read part 5: eshard.com/blog/kernel-uaf-5…
1
19
94
4,211
kmkz retweeted
Repeat after me. Docker is not a security boundary. Once again, with feeling.. DOCKER IS NOT A SECURITY BOUNDARY!
Docker sandboxes is probably the single most important tool you can learn in the AI age.
68
85
15
1,574
104,795
Docker👏🏻is👏🏻NOT👏🏻a👏🏻sandbox👏🏻
Docker sandboxes is probably the single most important tool you can learn in the AI age.
97
44
15
2,039
194,873
I wrote an article about browser's sandbox bugs davi-1337.github.io/posts/ca…
1
50
273
10,350
🚨During the past 24 hours, we have observed a small amount of actors targetting SSHole (CVE-2026-123158) Exploitation is not widespread yet, but is showing an early accelerating trend. Track exploit intelligence 👉console.defusedcyber.com/int…
3
8
1
19
2,777
Changing one letter bypassed an entire admin API in @huggingface chat. One request could trigger bulk internal exports of every user’s private chats, completely unauthenticated. Here’s how. 🧵
8
23
148
9,487
I'll be extremely curious to see Anthropic's exploit for CVE-2026-98432 working remotely
1
1
21
1,840
#letzpwn is back next Friday, 13th, same place, same time ... with you? Ice people, beers and offSec. Open to everyone or just curious - you're warned: -> No bullshit zone ! Like/share/tag someone who should be there * #letzpwn #OffSec #CyberSecurity #Community #Luxembourg – at Troisvierges, Luxembourg
1
625