Business Lead @DelphosLabs - AI cybersecurity. ex @productboard @segment @grammarly @getnanit. angel investor @hellopatient @cinderplatform. @TheCouncilCap.
New York
Joined February 2012
- Tweets979
- Following1.3K
- Followers832
- Likes3.1K
Cindy Berman retweeted
Full writeup on the Delphos Labs blog: delphoslabs.com/blog/usbvide…
Cindy Berman retweeted
Decompilers struggle at recovering variable types. The compiler throws them away and there is nothing in the binary to recover them.
Delphos took first place on types on DecBench, a new benchmark from the Noelo Lab at UGA. First on the overall metric too, ahead of claude-code, codex, and Ventris, and about 2.5x the perfect-recovery rate of any commercial decompiler on the board.
delphoslabs.com/blog/decbenc…
Cindy Berman retweeted
Kamil Leoniak found a descriptor parser bug in usbvideo.sys, the USB Video Class driver in Windows, during an automated Delphos Labs review of the compiled driver.
The validator accepts a descriptor that cannot advance the parser. The old path rejected bLength=0 because it checked whether the pointer would actually move forward. The newer path, behind Feature_Servicing_UvcDescriptPointerFix and on by default, checks only that the length fits in the remaining buffer. Zero fits, so the caller advances by zero and the loop parses the same descriptor forever.
34 bytes of configuration descriptor were enough, served from a Teensy 3.2 as a single-function UVC device. One core pinned at 100% in kernel mode, USB enumeration stopped system-wide, unplugging did not recover it, normal reboot blocked. Three times from a clean boot.
MSRC closed it on July 23 as not a bug. No CVE, no patch.
Cindy Berman retweeted
One of our security researchers at Delphos Labs, Kamil Leoniak, triggered kernel memory corruption on Windows using a custom USB device and a user-mode stress PoC. Microsoft assigned CVE-2026-50321, classified it as a Windows USB Driver elevation of privilege, and shipped the fix on July 14.
The bug is that the freed object reference stayed reachable long enough for another path to use it.
WinUSB_FreePipe frees a pipe context and only nulls the shared pointer afterward. In that window the interface pipe array still points at freed memory, and device-control IOCTLs dispatch on a WDF parallel queue, so nothing serializes access to that array.
16 threads were enough. 12 calling pipe policy APIs, 4 toggling alternate settings. A policy call read the stale pointer and took a spinlock inside a freed 0xF0-byte NonPagedPool object. Without Special Pool that allocation stays mapped and reclaimable. With it, the machine bugchecks.
Full writeup on the Delphos Labs blog, with the PoC on GitHub.
delphoslabs.com/blog/cve-202…
Cindy Berman retweeted
60+ AV engines called this file clean. The Delphos Labs platform called it ValleyRAT in five minutes, a full day before the first signature landed.
A freshly uploaded Windows executable, zero detections. The filename was the first tell: a Chinese-language lure translating roughly to "click here to visit the official Crab website."
From the binary alone, no sandbox detonation, no prior signature, no threat intel feed, we identified it as a Chinese RAT stager. Static analysis and emulation surfaced networking imports, process creation, crypto primitives, and anti-analysis checks.
The behavioral chain confirmed it. The stager pulls a ZIP from an AWS S3 bucket, extracts it, and drops a randomized-name second stage. String extraction returned the C2, a domain tied to carding forums.
The vendors caught up 24 hours later, long enough for the stager to run.
IOCs below.
delphoslabs.com/blog/39d4237…
ALT Delphos Labs ValleyRAT threat intelligence report cover
Cindy Berman retweeted
On July 30th we'll be at the AI Cyber Alliance Meetup in Tysons, VA.
Our CISO Joe Szczerba, ex-FBI Cyber Division Senior Exec who defended critical infrastructure from nation-state threats, speaks with @epowell101, CEO of DeepTempo.
Come say hi 👉 luma.com/aicyber-y9ry?utm_so…
Cindy Berman retweeted
A credential stealer took the name of libpsl-5.dll, a Windows library of approximately 200KB, and inflated itself to 55MB. Zero detections across 60+ AV engines when we analyzed it. The Delphos Labs platform pulled it apart on day one; the automated run took 8 minutes, with no human intervention. The vendors did not catch up for six days.
The bloated size is the primary evasion mechanism. The real code ends at about 3.3MB. The other 52MB is a single four-byte pattern repeated across the entire overlay, sitting outside every PE section and outside the image the Windows loader maps. The loader never reads it. It executes nothing. Its only job is to push the file past the size most engines and sandboxes scan.
No signatures. Detection came from the size mismatch, plus an import table pairing process injection with network enumeration, nothing a suffix-list library would do. Its code overlaps several known stealer families.
delphoslabs.com/blog/39d4237…
Cindy Berman retweeted
Today, we’re announcing Runlayer has raised $30M from Felicis and Khosla Ventures to help companies go all in on AI.
Runlayer is the golden path for AI: enablement, security, and control in one platform.
So, how does it give your team the right tools for AI? 🧵
Cindy Berman retweeted
One of our security researchers demonstrated a local root shell on Linux using a page-cache poisoning primitive in AF_RXRPC’s RxGK path.
We call it DirtyCBC: a sibling to DirtyFrag in the broader CopyFail / DirtyFrag / Fragnesia family. The issue is fixed on mainline.
The candidate path was surfaced through Delphos’s agentic analysis workflow, then manually verified and exploited end to end.
AES-256 was not broken. It just wasn’t the boundary that mattered.
RxGK decrypted data in place before authentication completed.
Under the right conditions, that write could land in the page cache. The HMAC check still failed and the connection was aborted, but the page-cache mutation had already happened.
Two RESPONSE packets were enough to place a tiny ELF into the cached first page of a readable SUID-root binary. The file on disk stayed unchanged. The next exec produced a root shell.
Full writeup and PoC on the Delphos Labs GitHub.
delphoslabs.com/blog/3614237…
Cindy Berman retweeted
I wanted to think through the implications of reverse engineering skills getting more accessible with AI and what it means that it's so much easier to take compiled code apart and understand it. So I wrote this: calebfenton.substack.com/p/t…
How long until someone takes some expensive closed source software and uses an LLM to "translate" the disassembly to C/C++ or even Rust? And just put it on github or pastebin or something. We're here. It's possible.
Cindy Berman retweeted
Our automated reverse engineering systems are starting to find vulnerabilities. First of many.
All black box. Only the compiled binary.
Identified using code reasoning.
Responsible disclosure underway.
Cindy Berman retweeted
I sat down with @Julie188 @TechCrunch to talk about my new company, Runlayer.
Cindy Berman retweeted
We raised $11M from Keith Rabois at Khosla and Felicis to make MCP work at scale.
MCP is everywhere, but it's MESSY.
No security. No auth layer. No visibility. No control.
We built Runlayer to enable AI.
Cindy Berman retweeted
@nikitabier @elonmusk - I've spent $200K and built something that will help X become the greatest app of all time (Really hoping this works lol).
The problem:
@X is drowning in millions of complaints and suggestions daily from passionate users:
“Edited post shows old version in embeds or previews.”, “Payment succeeded but the verification badge is not appearing.”,
“Group DMs not showing all participants."...scattered across tweets, app reviews, support tickets, and Reddit—zero structure.
You don't know whether 10 people or 10,000 are affected, or how to route the right feedback to the right team.
What @enterpret_ai does:
We automatically structure all customer feedback into a living knowledge graph—like a real-time map of every product issue.
"Payment failed," "HDFC card declined," "can't upgrade" all get filed in the same folder: Billing → Payment Processing → Regional Failures. Same issue, same folder, every time.
Our AI parses customer complaints to understand which parts of the product architecture they refer to, then surfaces them to the right product teams if urgent, or stores them in a connected knowledge graph for deep research with our AI.
When thousands of users from India tweet different versions of "can't pay for Premium," our AI knows:
- It's the same PREM_ERR_402 issue (not random complaints)
- 8,200 users affected with HDFC/ICICI cards
- $1.2M monthly revenue impact
- The payments team owns this fix
- Then automatically alerts them before it trends on Reddit
@enterpret_ai turns unstructured complaints into owned engineering work.
Grok can't do this. Ask it about "payment issues" or "Amex card declined," and it might say it's a checkout bug. No structured taxonomy, no knowledge graph connecting these as the same problem affecting thousands.
@nikitabier @elonmusk - I've already built an Enterpret instance for X. I'll personally fly to X HQ to show you how to fix your top 100 issues in 30 days.
We've raised $25M to build the best customer intelligence platform.
We're the secret behind how the most loved consumer apps like @NotionHQ , @perplexity_ai , @canva , @linear , @hinge , @Strava and @webflow maintain near-zero bugs while shipping fast.
For any company with 250K+ users, we guarantee $1M+ in savings from prevented churn and misdirected engineering.
Book a demo here: enterpret.com/demo
I'm giving away 20 iPhone Air units to people who Quote tweet with your best X improvement/complaint + tag @nikitabier @elonmusk.
Top 20 suggestions that resonate the most with people (by view count) win.
Cindy Berman retweeted
My employer, @DelphosLabs, is surveying the RE community to optimize the impact of our future development. It's only open for one more week. Last chance to participate! We'd love to learn more about you, your needs, or feedback on the public beta! Try it! docs.google.com/forms/d/e/1F…
Cindy Berman retweeted
What keeps CISOs up at night?
AI risk. Vulnerability management.
Staying resilient when the pressure’s real.
New threats move fast.
Regulators are louder.
Consumers are losing patience.
Boards want answers.
And AI makes it easier than ever for anyone to write an exploit.
Cindy Berman retweeted
We flagged this binary as Conti-style ransomware before checking threat intel.
All automated.
No unpacking. No signatures. Just behavior:
Threaded loader. AES/RSA encryption. Dynamic API calls.
It screamed “Conti” before we did.
Patterns > signatures.
delphoslabs.com/uploads/2b4e…
Cindy Berman retweeted
XZ backdoor (liblzma.so.5.6.1) fully exposed in minutes with Delphos Labs.
Black-box binaries? No more.
Traditional tools would still be unpacking.
That’s software, verified.
Black-box binaries? Over. We ran the xz-utils backdoor (liblzma.so.5.6.1) through our AI and it lit up: runtime JMP patching, custom byte-table crypto, encrypted IPC—caught in minutes. Full teardown 👉 delphoslabs.com/uploads/f382…
What would you audit next? #xzbackdoor #ReverseEngineering
Cindy Berman retweeted
Binary highlight: “Cyberpunk 7777 / QubePi” ELF. Text-menu game with hard-coded Postgres creds. Every login/chat/coord sent in clear on 5432—no TLS, no sanitization. Delphos auto-exposed the creds & flow in minutes.
Sample: delphoslabs.com/uploads/26cc…
#ReverseEngineering
Cindy Berman retweeted
Binary highlight: Modded DXGI.dll that spoofs an RTX 4090, hooks DXGI, and reroutes DLSS to OptiScaler’s FSR/XeSS. Hard to spot—but Delphos auto-flagged it and generated a clear write-up in a couple minutes. Sample: delphoslabs.com/uploads/577e… #ReverseEngineering via @DelphosLabs
