Security Vulnerability Coach, responsible for @x41sec and @persistent_psi Tweets here are my own.
Right here
Joined January 2009
- Tweets8.4K
- Following610
- Followers3.4K
- Likes8.7K
Pinned Tweet
Reality check your defenses! POC collection of the Month-of-Bypasses: github.com/persistent-securi…
Markus Vervier retweeted
Guess who has two thumbs, hasn't willingly used PHP since 2001 (except to write exploits), and always tells people not use it. Yep.
Markus Vervier retweeted
My non-hacking buddy asked me how much the person who found the php2shell made. Then he made a good observation:
Hack a small company, make a little. Hack a big company, make a lot. Hack 70% of the world, make nothing.
Nemesis Team on 🔥
Great to see us featured by the @Cyber_Coalition!
Our co-founder Babette De Decker spoke about her path to Nemesis, why cybersecurity needs diverse talent, and how we're making security validation accessible to all.
cybersecuritycoalition.be/in…
#Nemesis #ThreatToTest #Security
Let’s take this flaw as an example of how to defend against 0days:
First of all to set the expectations, nobody in their right mind can claim there is a 100% defense against 0days (vulnerabilities yet unknown except to some who are exploiting them)…BUT you can lower the chances of being hit!
How? In this example the attack vector are the file names that can be used to inject malicious payloads. If your application uses Pillow to process images, ask yourself if this requires allowing arbitrary file names? If not then don’t do it, use a uuid as a name => this takes away the attack surface required to exploit the vuln!
Doing this is the best way to reduce your exposure against yet unknown vulnerabilities!
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
thehackernews.com/2026/10/cr…
Markus Vervier retweeted
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
thehackernews.com/2026/10/cr…
Well…
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
No more security bugs in software in 18 month from now? Challenge accepted, we will find you some!
Markus Vervier retweeted
Nikos Laleas from our team took the stage at the @netpptechnology event to show how #Nemesis runs live, continuous attacks to see what security controls actually hold up.
A huge thanks to the Net++ team for putting together a great session at Hard Rock Cafe.
#ThreatToTest
Battlestar Galactica’s has the right approach against AI hacking threats: youtu.be/OPKGbg16ulU
Markus Vervier retweeted
"We had our hands on it, and we called it a crash."
In 2024, Mihail Kirov's @Quarkslab team reported a flaw in the exact code behind PHP2Shell. Two years later, three teams turned it into a working attack in six weeks.
His story:
tolmo.com/blog/faster-than-a…
cc: @cryptonitemmk
A liability with a timer on it:
tolmo.com/blog/faster-than-a…
Markus Vervier retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
We’ve put quite some effort into making a full AEV solution available and affordable for even smaller businesses! Including AI that can work in air gapped environments like OT and explore attack paths in safe and controlled way! 🚀
Some environments thrive in the cloud, others demand on-premise control especially in regulated sectors
Nemesis handles both effortlessly by running #localAI model inside your own system.
Get continuous attack validation w/o compromising on where your data lives.
#ThreatToTest
Markus Vervier retweeted
Some environments thrive in the cloud, others demand on-premise control especially in regulated sectors
Nemesis handles both effortlessly by running #localAI model inside your own system.
Get continuous attack validation w/o compromising on where your data lives.
#ThreatToTest
Markus Vervier retweeted
We’re heading to Techtonics!
Our co-founder Babette De Decker will be there representing Nemesis, ready to catch up w familiar faces, make new connections and talk about where defenses break down.
If you're attending, come say hi 👋
#Techtonics2026 #Networking #cybersecurity
🤖 Made with AI
Markus Vervier retweeted
Loved catching up with old friends and making new ones at @_c0c0n_ 2026!
Getting such a warm welcome from Kerala Police was a highlight, along with @marver's training session.
Big thanks to the organizers, volunteers and speakers for a great event 👋
#c0c0n2026 #cybersecurity
Wow I really managed to look like the evil red team guy in this one! 😈
A month ago I rented an Irish Bar and hosted an AI security panel + speakeasy. Here is the 35min panel youtu.be/ShMq_vH44LU
Lots of fun content here.. I've gotta put more of these on the books.
