We decided to revisit an old research problem with some new LLM powered tooling. Check out our latest blog post to see how we approached this research, and the new Java deserialization gadget chains it discovered in just two days! www.atredis.com/blog/2026/3/12/findings-gadgets-like-its-2026

On a recent engagement, we exploited a previously disclosed privilege escalation bug in Tenable's Nessus Agent. No public PoC was available, so we made one; check it out here github.com/atredispartn...

Another day, another audit of a vibe coded app with almost no security controls. 🫗

Atredis identified a vulnerability in the way Rapid7's Nexpose was generating passwords to protect its Java KeyStore which is used to encrypt saved credentials. This vulnerability was reported to Rapid7 and a patch is being rolled out today! Check out the details here: github.com/atredispartn...

Tanium is great enterprise c2.

Command & Conquer'd: worming RCEs through a classic multiplayer game. Check out the full writeup from our @districtcon.bsky.social Junkyard submission here: www.atredis.com/blog/2026/1/... By @droner.bsky.social and @jordan9001.bsky.social #Security #modding #rce

[RSS] When NAS Vendors Forget How TLS Works www.interruptlabs.co.uk -> #QNAP #Synology #Pwn2Own #NoCVE Original->

[RSS] Districton 1 Slides - Control the Variables and You Control the Code: Language-Level Vulnerabilities in Adobe ColdFusion www.hoyahaxa.com -> Original->

Thank you @districtcon.bsky.social, it was a wonderful conference, and we're looking forward to next year! ❤️

You like technical deep dives into binary exploitation and crazy heap wizardry? Then you'll like our blog post about unauth'ed RCE in NetSupport Manager aka CVE-2025-34164 & CVE-2025-34165 code-white.com/blog/2026-01...

DISTRICTCON IS STILL A GO! We are excited to see you all on Saturday, January 24 as we are still going through our normal programming! While we are unable to process refunds, we are adding virtual components to Saturday AND Sunday including a livestream for public sessions for ticket holders.

This weekends weather forecast is a good reminder: Fuck ice

We still have seats open for @blackhoodie.bsky.social at @districtcon.bsky.social on January 23rd in Washington DC! The class will be reverse engineering their way through an integer overflow bug in libpng 🤓 blackhoodie.re/DistrictCon2...

It's so sad that he thinks we don't have eyes and haven't seen the videos ourselves. She was not "trying to ram the officer." Fun fact: when you are trying to ram an officer, you turn the wheels towards them, not away from them. Extra fun fact: shooting someone trying to ram you doesn't stop them.

Fuck ICE.

Any recommendations for exploit dev focused #CTF with an archive of challenges? I'm looking for samples and interested in code comprehension, less interested in obfuscation/VMs. Original->

We have 2 student sweepstake tickets up for grabs to attend RE//verse 2026! These cover conference admission and meals. Travel and hotel are not included, so you must be able to travel to Florida. Ticket is non-transferrable. Email [email protected] by Jan 16th with the following:

Blind trust: what is hidden behind the process of creating your PDF file? swarm.ptsecurity.com/blind-trust-... #vulnerability #cve #exploitation #infosec

When the codebase you've been auditing for the past month is mature and secure by default.

Last week, hardware. This week, firmware! Sam is back with a deep dive into his LiDAR Detector and demos a couple prototypes! www.atredis.com/blog/2025/12...

Our LG refrigerator is 2 years old and cost $2,100 when we bought it. The condenser fan motor is failing and LG wants to charge $400 to fix it. Have they considered making better quality products? Jesus christ, we'll fix it ourselves.

had to make a gif of the goodest boy

Say Cheese, Computer! Designing a Sensor for Passive Detection of iPhone TrueDepth LiDAR www.atredis.com/blog/2025/11/20/designing-a-passive-lidar-detection-sensor

VulnCheck is #hiring (senior) exploit developers in the U.S. and UK! If you love writing RCE exploits but also want to help customers detect exploitation and assess exposure, this is a fantastic place to learn and grow! Open roles here - we're also looking for UK engineers: www.vulncheck.com/careers

TL;DR Middle management is hard. Caring is required, but the kind of care you provide matters.

George says gobble gobble, happy thanksgiving, and fuck ICE.

Windows 11 requiring weird hacks to only use a local account. Microsoft are a bunch of cunts for forcing online account onto people.

Sometimes you audit a codebase and are just absolutely blown away by how elegant and well thought-out it is. 🤌

Our Black Friday Sale is now active! Take 42% off everything with code BLACKFRIDAY25. Grab the books you’ve been eyeing. Sale ends 12/2. https://nostarch.com/

We took WPScan's one-liner #security advisory for CVE-2025-9501 affecting the W3 Total Cache plugin for #WordPress, analysed its cache parsing internals and built a pre-auth RCE exploit for it 😎 www.rcesecurity.com/2025/11/expl... #infosec

We sold out of our GA tickets in 15 seconds 🤯 For students: Thanks to our community sponsors, our DistrictCon Scholars' Program application is open! For anyone else passionate about DisCo: Volunteer with us! You can also join our waitlist on Eventbrite! All info here: www.districtcon.org/tickets

Got mine! That was stressful 😅 Looking forward to seeing you all there!

Looking good a good tutorial on debugging with ghidra. I want to set breakpoints, change flow, and modify memory values. Is that possible?

Let's Hack Something Cute! A Reverse Engineering Journey into the Drawbot with Jessie www.atredis.com/blog/2025/9/...

I've been following the @xbow.com stuff for a while now and have been really impressed by their blog posts and findings, so I'm extremely surprised/disappointed by the poor quality of their sample report on their new on-demand pentest offering at xbow.com/pentest for a lot of reasons.

This whole system is fucked.

every AI ad is like “hey gemini, what would i have for lunch?” and then the phone is like “sandwich” and the guy is like “wow”

I have a close friend who spent the last 15 years as an ETL developer and whose department was recently laid off (jobs were outsourced). If anyone has or knows of any openings, this guy is intelligent, personable, and overall a great person, and I'd love to put you in touch. Reposts appreciated!

Y'all fantastic news! Save the date, @blackhoodie.bsky.social will be at @districtcon.bsky.social this year 😱 the fantastic crew has offered to host us for a day of Malware Reverse Engineering! @synapticrewrite.bsky.social and myself will be hosting a training for women by women on January 23rd!!

POLLS ARE NOW OPEN. Find out where you early vote ⬇️ 🗳️ findmypollsite.vote.nyc

Day 2 of #Pwn2Own Ireland is in the books. So far, we've awarded $792,750 or 56 unique 0-days. Tomorrow could be even better with more Samsung, a Meta Quest entry and that big WhatsApp entry still lingering. Here's the current Master of Pwn leader board. See you tomorrow!

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo: youtu.be/BAZ-z2fA8E4

Pop a vendor website, replace their /.well-known/security.txt with your own rogue contact info, and wait for the bugs to roll in.

Junkyard closes on Friday, Oct 24 at Midnight!!! Submit here: www.districtcon.org/junkyard

😍 Boston, you are beautiful. #NoKings

Wow the Nexpose user interface is horrible these days, eh? Absolutely fucking terrible.

y2038 progress retr0.id/stuff/2038/

It has been about two decades since I last needed/used one, but is there any modern KVM switch that works with Mac’s properly? Lost faith in a wide screen Picture in Picture monitor so hope the KVM world is better