Vincent retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
Vincent retweeted
Excited to share this! Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox. This blog post describes the exploitation process of a use-after-free vulnerability in the SVGA subsystem to achieve code execution on the Linux host machine. Enjoy!
blog.exodusintel.com/2026/06…
Vincent retweeted
We just had our second certified SA-RIOT
From his own words:
Ex1 and 3 were fun.
I think overall they were good exercises and at the right level.
C'mon we have Exam at 50% discount...
Vincent retweeted
Half satisfied because a zero day I found in February 2025 has unluckily been patched in April 2026 😢, it was a tricky use-after-free in Adobe Acrobat Reader's Escript.api 😄. Here is my write-up, with a video PoC popping calc as a bonus: blog.exodusintel.com/2026/06…
Vincent retweeted
We’re opening the Exodus research vault.
Over the coming weeks, we’ll publish technical writeups highlighting vulnerability research, exploit development, and deep reverse engineering from our team.
First up: Michele Campa’s Adobe Acrobat Reader Escript.api use-after-free RCE.
blog.exodusintel.com/2026/06…
#VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #OffensiveSecurity #CyberSecurity
Vincent retweeted
A zero day I found last year has been patched on October (CVE-2025-55680) :(, it was a nice and easy patch bypass. Here the write-up blog.exodusintel.com/2025/10…
Vincent retweeted
We dissect a DFG compiler bug we discovered in Safari/WebKit. This post covers root cause, impact, and technical analysis:
blog.exodusintel.com/2025/08…
#WebKit #VulnerabilityResearch #ExploitDev #Safari #CyberSecurity #ExodusIntel
Vincent retweeted
So like. Time to be vulnerable for a minute and talk about mental health as it relates to research. Because it’s tough, you know, open-ended research (as are many careers). That constant fear of failure in the face of tasks that are sometimes literally impossible.
I think it’s the UX more than the UI that is preventing a move away from IDA.
Vincent retweeted
For my friends considering a move to bluesky, I just checked back in there and it's nice. I enjoy the ability to curate my social media experience and think it's better for everyone's mental health to avoid the toxicity you might find elsewhere.
Vincent retweeted
Random Tweet!
I've been authoring and teaching at the SANS Institute for well over 10 years. I have and have had the fortune of working with some of the brightest minds in the industry. My choice and ability to run the Off By One Security channel to give back to the community is not only encouraged by SANS, but also expected.
Another example of giving back that I previously tweeted is @jon__reiter's 10-workshop series on Introduction to C which you can find here: sans.org/webcasts/intro-c-wi…
Today, on the Off By One Security stream, we covered a session on introduction to JavaScript and V8 for browser exploitation: youtube.com/watch?v=ctKCfXOg…
If there's more content you'd like to see on the channel, you can join the ~2K member Discord server here and request them: discord.gg/offbyonesecurity Let me know what you want to see and I'll try my best to make it happen!
I get asked often and so I want to mention this: Through the work-study program, instructor development, CyberStart, Vet Success, Women's Academy, the SANS Technology Institute (STI) College, and many other programs, there are A LOT OF opportunities to take advantage of great training.
I'm not one to market, and have no plans to change that, but join my Discord and reach out to me with your goals and challenges, and I'll do my best to help.
It's impossible to make everyone happy, though I wish it were... If you ever have questions about something you read online, hear from a peer (or stranger), or other, I will do my best to get back to you! I try my best to ensure I give credit to everyone who has helped to further my career. Sadly, not everyone does the same. None of us wouldn't be here today in the industry if it weren't for the amazing work and contributions done by countless people. Often, I've wanted to reply to postings that I feel are dishonest or unfair, but I choose to instead encourage and speak positively about everyone, even those who choose to be negative.
Finally, we had over 6,500 virtual attendees join us live at Hackfest! Another amazing way I enjoy helping to give back to the community! Though the thanks goes to the incredible speakers who came out and shared their knowledge! I attended a recent virtual conference that charged to attend. My goal is to continue bringing you amazing content. Let me know how I can improve that goal.
Thanks!
Vincent retweeted
Instructors and students: Do you use @FuzzingBook or @Debugging_Book and would like to help shaping their future? If so, fill out our 2024 reader survey at forms.gle/pMDftr94GfLYyJHs7 and help us find out about our readership!
Vincent retweeted
Let's discuss university degrees and whether or not they're required for cybersecurity.
This may come as a shocker to some people, but universities are higher education institutions. Universities are not job fairs. If you attend a university your primary objective is to get an education and hope that this can directly transform into getting a career where you can apply this knowledge. A university does not necessarily mean you're being taught cutting edge material and it does not guarantee a job anywhere.
An education is not the same as on the job experience and it does not directly correlate to what is (or is not) trending in the market place. Some employers discriminate against people who do not hold a degree because they believe the person may lack sufficient educational requirements for the position, but fail to realize on the job experience may be superior to a traditional higher education route.
If you've got a degree, that is very cool. Congratulations.
If you do not have a degree, that is very cool. Congratulations.
Cybersecurity is a unique career field in that there is no traditional career path to reach the 'end goal'. It is a flexible career field and can accommodate essentially anyone regardless of how they tailored their skills.
Having a degree does not make you a superior person. Not having a degree does not make you a superior person. We are all colleagues. Be nice to each other.
Enjoy your weekend.
Vincent retweeted
I just live hacked @ArleneDickinson (Dragons' Den star - Canada's Shark Tank) by using her breached passwords, social media posts, an AI voice clone, & *just 1 picture* for a deepfake live video call.
Thank you @ElevateTechCA @Mastercard for asking me to demo these attacks live!
Vincent retweeted
American intellectual elites love to cite Singapore as a shining example of success and good economic management. Many of them have never been to Singapore or much less spent much time there. I was a student there for nearly 5 years attended the same schools as LKY and Lee Hsien-Loong.
A few key differences that make Singapore challenging to replicate in the West:
- Singapore is a tiny island
- culturally the predominant Chinese population instinctually see the govt in a parental role, even more so than the HK population. (The British influence they had was more the tight upper lip cultural conservative civil service kind unlike the ruckus seafaring trading adventurers types HK had.)
- Singapore benefitted successively from the entrepôt trade, manufacturing outsourcing and the rise of China (lately its economic model has seemingly stalled.)
- Most importantly, what the all powerful and all competent state and civil service of Singapore managed to do to fine tune Singapore into a well oiled machine came at an expense: it smothered creativity and risk-taking. (What was the last great start up you heard of that came out of Singapore?)
So sure, Singapore’s govt sends its best students on scholarships to the world’s best universities in the US, UK and Europe to have them return to serve in govt at high salaries. Maybe that means excellent and efficient public administration, but I do think it comes at a cost greater than the govt cares to admit. And it is at complete odds ironically with what made SF the heart of global innovation.
