Security Researcher, Pen tester, Hacker, Speaker, Teacher, and IoT abuser.
Joined March 2009
- Tweets2.6K
- Following868
- Followers2.9K
- Likes1.9K
Just got back home last night after visiting the beautiful city of Mechelen Belgium, where i had the opportunity to speak at this years @brucon conference (AfterDark). Many thanks to the conference team for giving me that opportunity, and for putting on such an amazing event.
Excited to announce i well be speaking at @brucon next Thursday Sep 24 in the BruCON After Dark track at 8pm. My talk will be "CatSocks - Cellular AT Command Socks5 Injection Application" So please join me for my After Dark session at 8pm - brucon.org/conference
Deral Heiland retweeted
🚨 In July 2026, while conducting a 0-day research project against Microsoft #SharePoint, Rapid7 Labs discovered 2 new vulns that, when chained together, achieve unauthenticated RCE against a SharePoint server.
Deral Heiland retweeted
Join @Percent_X & Carlota Bindner at #IoTVillage to learn about MitM inter-chip attacks and cellular hardware defense in "Weaponization of Cellular Based IoT Technology"!
🗓️ Saturday of DEF CON | 16:30 - 17:30 📍 Stage 3
Been attending @defcon since DC10. Not sure if I am in a rut or addicted. Each year I sware I hate Vegas and not going back, but 30 days later I am planning for the next. This will be 9th year with @IoTvillage running hands-on hardware hacking. Looking forward to seeing everyone
Deral Heiland retweeted
🔓Thanks to an exposed server, Rapid7 researchers managed to pull down an attacker's entire toolkit: staged payloads, lure templates, testing files, campaign artifacts & more.
That sloppiness offered a rare view of a malware delivery pipeline, end-to-end: r-7.co/3RnpqLC
I will be @CackalackyCon in Raleigh, NC on May 15–17, where I’ll be speaking cackalackycon.org/
Also, a couple of my @rapid7 penetration team members and I will be running hands-on hardware hacking exercise. So join us and learn some fun hardware hacking techniques.
Excited to share that I’ll be speaking at @HackSpaceCon on May 9 in Cape Canaveral, Florida!
hackspacecon.com/
So just got back yesterday from #RSAC where i presented "Exploiting Cellular IoT Pathways to Compromise Trusted Access". I had an amazing time. Also, @CarlotaBindner and I released a new white paper on the subject. Please check it out- rapid7.com/blog/post/tr-new-…
Deral Heiland retweeted
Make room in your RSAC itinerary for Principal Researcher (IoT) Deral Heiland's session on how hardware hacking techniques exploit cellular IoT to gain trusted access & how organizations can better defend against these risks.
Get the details: r-7.co/3PywfbV | @Percent_X
RSAC Conference is less than a month away, and I’m excited to announce that I’ll be speaking on March 24, 2026 at 1:15 PM PDT.
🎤 NCS-T09 – Exploiting Cellular IoT Pathways to Compromise Trusted Access
Session details: lnkd.in/evPytdjx
I hope to see everyone there !
I have starting to prep the @rapid7 hands-on hardware exercise for @defcon @IoTvillage. I have a plan and have started acquiring the needed devices and tools. More detail will be posted as we get closer to #hackersummercamp
Deral Heiland retweeted
Bug in widely used VoIP phones allows stealthy network footholds, call interception (CVE-2026-2329) - helpnetsecurity.com/2026/02/… - @rapid7 @stephenfewer @fulmetalpackets @GrandstreamNet #IPphones #SecurityUpdate #SMBs #VoIP #Vulnerability #Cybersecurity #CybersecurityNews
CyberBay Conference in Tampa Florida is only a month away. Please join me on March 12th for a discussion on building out an IoT embedded device security testing program - cyberbay.org/
Deral Heiland retweeted
🚨 On 2/6/26, #BeyondTrust disclosed a critical RCE vulnerability affecting its Remote Support (RS) and Privileged Remote Access (PRA) products.
The flaw has been assigned CVE-2026-1731 and a near-maximum CVSSv4 score of 9.9.
More in the Rapid7 blog: r-7.co/4arAjln
How it started and how it went - check out my CES 2026 review videos:
youtu.be/86CpgYTJfGw
youtu.be/VYEkjckAlWc
#CES2026
Attending CES2026 this week and I can now claim officially I have seen it all. A smart vacuum cleaner with its own drone delivery feature. #CES2026
Deral Heiland retweeted
🚨 On 12/19/25, MongoDB Inc. disclosed a critical new vuln. affecting #MongoDB – one of the most popular document-oriented databases.
CVE-2025-14847, or #MongoBleed, is a high-severity unauthenticated memory leak. More in the Rapid7 blog: r-7.co/4piWbER
Released a new White paper last week "Multifunction Printer (MFP) Security Concerns within the Enterprise Business Environment" You can link to the white paper from the following @rapid7 blog, Please check it out - rapid7.com/blog/post/ve-new-…
It was great time chatting with with Joe Pannone at CyberBay on the “Discipline Conversations” podcast. Please check it out: open.spotify.com/episode/27X…
