Manfred Paul @_manfp

Security but not as in "national security". Playing CTFs with @redrocket_ctf (and @Sauercl0ud). Pwn2Own Vancouver 2020..=2024\{2023}. @[email protected] Outside of computed bounds Joined January 2020

Tweets

83
Followers

5K
Following

315
Likes

378

Trend Zero Day Initiative @thezdi

2 months ago

CVE-2025-4941 - Trend ZDI analyst @hosselot details the Firefox bug used at #Pwn2Own Berlin by Manfred Paul. Includes root cause analysis and video demo. zerodayinitiative.com/blog/2025/7/14…

4 32 128 13K 60

Manfred Paul @_manfp

6 months ago

If you're a security researcher and in Germany, consider signing cysec-reform.jetzt . Decriminalizing research might not be the top political priority right now, but it's still important!

1 12 78 10K 16

David Mirren @davidmcgeoch9

8 months ago

More important than ever!!

954 79K 151K 4.0M 3K

Download Image

@ecsc2024 @MITAmalta @MITAmalta, this is not how you build up a cybersecurity community in your country. It was great to see a lot of ECSC players show their support people like @_mixy1 who faced both disqualification and legal action. As the vulnerability research community, we should do the same.

0 4 19 4K 0

Tavis Ormandy @taviso

a year ago

This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n

255 3K 16K 3.3M 5K

Download Image

Jack Ren @bjrjk

a year ago

Exploit for Pwn2Own CVE-2024-29943, an Integer Range Inconsistency caused OOB access! Analysis will be updated later. Shoutout to @_manfp for finding this bug. And shoutout to @maxpl0it for his integer range inconsistent PoC. github.com/bjrjk/CVE-2024…

10 65 294 41K 109

Download Video

h0mbre @h0mbre_

a year ago

think i found a bug. which means it’s time to take a break and enjoy the possibility before looking more closely and finding out there’s a check in an upstream code path I missed

7 17 205 19K 11

Alec Muffett @AlecMuffett

a year ago

@chrisrohlf @mncoppola Keeping open a bug to support a government operation is isomorphic to opening a backdoor to support a government. I'm pretty sure you wouldn't want Google to keep a bug open for the benefit of China, Chris. alecmuffett.com/article/109963

2 4 17 3K 2

GrapheneOS @GrapheneOS

a year ago

theguardian.com/world/2022/feb… Is this the "counterterrorism operation" by a U.S.-allied Western government that's being referenced? If saying the country and "terrorist" group involved paints a flattering picture of these exploit tools, why aren't they saying which ones are involved?

1 8 68 6K 7

Google VRP (Google Bug Hunters) @GoogleVRP

a year ago

This years Google CTF Qualification is over. Congratulations to @kalmarunionenDM, kijitora and Zer0RocketWrecks! The top 8 teams qualified for Hackceler8 2024 in Málaga. More details at goo.gle/ctf. ¡Vamos!

0 19 90 15K 13

Bart Preneel @bpreneel1

a year ago

Good news: vote on chatcontrol postponed. But this monster keeps raising its head: efforts to stop it need to be continued.

CCC Updates @chaosupdates

a year ago

Good news: vote on chatcontrol postponed. But this monster keeps raising its head: efforts to stop it need to be continued.

11 148 410 33K 16

3 70 221 39K 4

Manfred Paul @_manfp

a year ago

Happy to have my write-up on @thezdi's blog again - after so many fights with some kind of range analysis, a bug that just directly gives every type confusion you want felt quite fun

Trend Zero Day Initiative @thezdi

a year ago

Happy to have my write-up on @thezdi's blog again - after so many fights with some kind of range analysis, a bug that just directly gives every type confusion you want felt quite fun