Vitaly Simonovich

Security Researcher

Vulnerability Research · Threat Intelligence · AI Security

Senior security researcher working across vulnerability research, threat intelligence, and AI security. I break systems the way real attackers do, from core internet infrastructure like DNS and glibc to browsers, web platforms, and LLMs, and turn those findings into practical defenses, threat reports, and education so organizations can stay ahead of attackers.

githublinkedinxRemote, available worldwide

Last updated: August 11, 2026

At a glance

  • 10+Years Experience
  • 24CVEs Discovered
  • 12Public Speaking
  • 41+Press Mentions

Areas of expertise

  • Vulnerability Research
  • Threat Intelligence
  • LLM & GenAI Security
  • Jailbreaks & Prompt Injection
  • Application Security
  • Data Security
  • Offensive Security & CTFs
  • Security Education & Public Speaking

Highlights

  • DEF CON 34 Main Track

    C(2)YA: Inside the Adversary's Inbox — six months of LLM-assisted research against five C2 frameworks (Havoc, Mythic, Sliver, Covenant, AdaptixC2) yielding 251 findings, 85 exploitable straight from the internet, and 28 takedown chains.

  • HashJack Research

    First known indirect prompt injection technique weaponizing URL fragments to manipulate AI browser assistants. Covered by Forbes, The Register, and The Hacker News.

  • Apple WebKit Vulnerabilities

    Three flaws in Apple WebKit (CVE-2026-28917, CVE-2026-28962, CVE-2026-43700): a memory-safety crash, an information disclosure issue, and a cross-origin leak of sensitive user data.

  • NVIDIA TensorRT-LLM Vulnerabilities

    Two flaws in NVIDIA's LLM inference engine (CVE-2026-24226, CVE-2026-24234): improper control of code generation, and a server-side request forgery in multimodal media fetching.

  • Operation Poisson

    A 33-day French-speaking cybercrime operation captured command-by-command, revealing how a junior operator used Tailscale and OpenSSH to keep access after his C2 went offline. Covered by The Hacker News.

  • MongoDB Hall of Fame

    Pre-authentication denial of service in MongoDB Server (CVE-2026-25611, High severity) and induction into the MongoDB Security Researcher Hall of Fame.

  • Core Infrastructure CVEs

    A 2026 run of vulnerability discoveries across the internet's backbone: BIND 9, PowerDNS, Jenkins, WordPress, and Google Chrome.

CVEs discovered (24)

10 High · 11 Medium · 3 Low.

CVEVendorSeveritySummary
CVE-2026-24234NVIDIAMediumTensorRT-LLM multimodal SSRF. Server-side request forgery in the multimodal media fetching functions of NVIDIA TensorRT-LLM for Linux, where a network-accessible attacker can steer the inference server into issuing attacker-controlled requests, leading to information disclosure and denial of service. Affects TensorRT-LLM through v1.3.0 rc16.
CVE-2026-24226NVIDIAMediumTensorRT-LLM improper control of code generation. Improper control of code generation in NVIDIA TensorRT-LLM for Linux, where functionality is included from an untrusted control sphere; a successful exploit can lead to code execution, data tampering, and information disclosure. Affects TensorRT-LLM through v1.3.0 rc12.
CVE-2026-48936Node.jsLowPermission model network bypass via Unix socket. Incomplete fix for CVE-2026-21636 in the Node.js Permission Model: a local server can be started over a Unix domain socket without the --allow-net permission, bypassing the intended network restrictions. Affects Node.js 26; fixed in 26.3.1.
CVE-2026-55827FreeRDPHighRemoteFX heap buffer overflow. Heap buffer overflow in FreeRDP where the GDI layer passes desktop surface dimensions instead of bitmap dimensions as write bounds to the RemoteFX decoder, letting a malicious RDP server write past the allocated bitmap buffer with attacker-influenced content and potentially hijack execution. Affects 2.0.0 through 2.11.7 and 3.0.0 through 3.27.0; fixed in 3.27.1.
CVE-2026-55564FreeRDPMediumGlyph cache out-of-bounds read. Off-by-one error in FreeRDP's glyph_cache_get() bounds check lets a malicious RDP server trigger an out-of-bounds heap read via crafted glyph fragments, dereferencing one slot past the glyph cache array and potentially causing denial of service or information disclosure. Affects versions up to 3.26.0; fixed in 3.27.0.
CVE-2026-28917Apple WebKitMediumMemory-safety process crash. Memory-safety issue in Apple WebKit where processing maliciously crafted web content can cause an unexpected process crash (denial of service). Fixed in Safari 26.5 on macOS Sonoma and macOS Sequoia.
CVE-2026-28962Apple WebKitMediumInformation disclosure. Information disclosure vulnerability in Apple WebKit where processing maliciously crafted web content may reveal sensitive user information. Fixed in Safari 26.5 on macOS Sonoma and macOS Sequoia.
CVE-2026-43700Apple WebKitMediumCross-origin information disclosure. Cross-origin issue in Apple WebKit where security origins were not tracked correctly, letting maliciously crafted web content disclose sensitive user information across origin boundaries. Fixed in Safari, iOS, iPadOS and macOS 26.5.2, and in tvOS, watchOS and visionOS 26.6.
CVE-2026-5913Google ChromeLowOut-of-bounds read in Blink. Out-of-bounds read in the Blink rendering engine in Google Chrome prior to 147.0.7727.55 allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Affects Chrome on Windows, Linux, and macOS.
CVE-2026-33608PowerDNSHighBackend DoS via crafted NOTIFY. Incomplete domain name sanitization during Bind autosecondary zone transfer in PowerDNS Authoritative Server allows an attacker to send a notify request causing a secondary domain to be added with invalid configuration, rendering the Bind backend inoperable after restart. Affects versions up to 5.0.3 and 4.9.13.
CVE-2026-33257PowerDNSMediumWebserver memory exhaustion. Insufficient input validation of the internal webserver in PowerDNS Authoritative Server and DNSdist allows an unauthenticated attacker to send crafted HTTP requests causing unlimited memory allocation and denial of service. Requires the web server feature to be enabled. Affects PowerDNS Authoritative 3.4.0–5.0.3 and DNSdist up to 2.0.3.
CVE-2026-42390PowerDNSMediumRecursor ZONEMD validation bypass. ZONEMD verification bypass in the PowerDNS Recursor: the digest compare loop does not re-check scheme eligibility, so a zone carrying a reserved scheme=0 ZONEMD record with the correct digest passes validation even when the eligible record's digest is wrong. Relevant when Zone-to-Cache is configured with zonemd: require. Affects Recursor 5.4.0 through 5.4.2; fixed in 5.4.3.
CVE-2026-42004PowerDNSLowDNSdist EDNS options smuggling. EDNS options smuggling in PowerDNS DNSdist: a crafted EDNS OPT record is ignored by DNSdist's filtering rules but rewritten as a valid OPT record when EDNS Client Subnet is inserted, so the backend receives EDNS options that DNSdist did not filter. Affects DNSdist up to 1.9.14 and 2.0.6; fixed in 1.9.15 and 2.0.7.
CVE-2026-3104ISC BIND 9HighResolver memory leak DoS. Memory leak in BIND 9 resolvers triggered by specially crafted domain queries, causing denial of service through resource exhaustion. Affects BIND 9.20.0–9.20.20 and 9.21.0–9.21.19.
CVE-2026-3119ISC BIND 9MediumCrash via TKEY query. Authenticated query containing a TKEY record with a valid TSIG can cause the BIND named daemon to terminate unexpectedly. Affects BIND 9.20.0–9.20.20 and 9.21.0–9.21.19.
CVE-2026-33001JenkinsHighArbitrary file write via symlinks. Link following vulnerability in Jenkins 2.554 and earlier, LTS 2.541.2 and earlier allows crafted .tar and .tar.gz archives to write files to arbitrary locations via symbolic links, enabling code execution by attackers with Item/Configure permission or control of agent processes.
CVE-2026-25611MongoDBHighPre-auth memory exhaustion DoS. Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server. A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.
CVE-2025-15281glibcHighUse-after-free in wordexp(). Use-After-Free vulnerability in glibc's wordexp() function when using WRDE_REUSE and WRDE_APPEND flags, allowing memory corruption and potential code execution via uninitialized memory access.
CVE-2026-0859TYPO3MediumInsecure deserialization in mailer. Insecure Deserialization vulnerability in TYPO3 CMS Mailer file spool allowing local users with write access to the spool directory to inject and execute arbitrary PHP code via crafted serialized files.
CVE-2026-49740TYPO3MediumInsecure deserialization in Core API. Insecure deserialization in the TYPO3 CMS Core API (ext:core) where crafted serialized data can affect downstream components. Fixed across TYPO3 13.4.31 LTS, 14.3.3 LTS, and ELTS releases.
CVE-2025-67849MoodleHighStored XSS in AI Course Assist. Stored Cross-Site Scripting (XSS) vulnerability in Moodle's AI Course Assist via unsanitized HTML rendering in the response template, allowing authenticated users to execute arbitrary JavaScript and steal session tokens.
CVE-2025-64496Open WebUIHighCode injection via SSE. Code Injection vulnerability in Open WebUI via Server-Sent Events (SSE) in Direct Connections feature, allowing malicious external model servers to execute arbitrary JavaScript and steal authentication tokens.
CVE-2025-52670Revive AdserverHighAuthorization bypass (IDOR). Authorization Bypass (IDOR) vulnerability in Revive Adserver allowing authenticated users to delete banners owned by other accounts via improper ownership validation.
CVE-2025-52668Revive AdserverHighStored XSS. Stored Cross-Site Scripting (XSS) vulnerability in Revive Adserver's statistics-conversions.php script via tracker or campaign names, enabling session hijacking and information disclosure.

Awards & recognition (8)

  • Security Research Acknowledgement, Apple (2026)

    Recognized in Apple's security advisories for WebKit and WebKit Storage research, alongside credited WebKit vulnerabilities.

  • Product Security Acknowledgement, NVIDIA (2026)

    Credited on NVIDIA's Product Security Acknowledgements page for reporting two vulnerabilities in TensorRT-LLM.

  • Security Vulnerability Credit, WordPress (2026)

    Credited for reporting an AJAX query-attachments authorization bypass, fixed in WordPress 6.9.2.

  • Security Vulnerability Credit, ISC (BIND9) (2026)

    Credited for reporting a NULL pointer dereference crash in BIND9's QP-trie cache, fixed in BIND 9.21.19.

  • Security Advisory Credit, Jenkins (2026)

    Credited for independent discovery of a link following vulnerability in Jenkins, reported through the Jenkins Bug Bounty Program sponsored by the European Commission.

  • Security Researcher Hall of Fame, MongoDB (2026)

    Recognized for responsibly disclosing a security vulnerability in MongoDB products.

  • AI Safety - Immersive world jailbreak, Microsoft (2025)

    Awarded for discovering the 'Immersive world' jailbreak in Microsoft's copilot.

  • AI Security - Edge browser prompt injection, Microsoft (2025)

    Indirect prompt injection vulnerability found in Microsoft's edge browser.

Research (21)

Speaking (12)

  • C(2)YA: Inside the Adversary's Inbox

    DEF CON 34 · 2026-08-08 · Las Vegas, NV, USA

    Six months of LLM-assisted research against five C2 frameworks — Havoc, Mythic, Sliver, Covenant and AdaptixC2 — surfacing 251 design flaws and vulnerabilities, 85 of them exploitable from the internet with no prior access, plus 28 takedown chains and crypto failures that decrypt all C2 traffic from a single recovered key.

  • HashJack: Exploiting URL Fragments to Hijack AI Browser Assistants

    Ekoparty Security Conference · 2026-05-22 · Miami, FL, USA

    An indirect prompt injection technique that hides malicious instructions in URL fragments to hijack AI browser assistants, with real attack scenarios and defensive guidance.

  • Agentic Security: Past, Present, and Future

    SASEfy 2026 · 2026-05 · Virtual

    A panel on the past, present, and future of agentic AI security, presented with Cato CTRL's Etay Maor and Microsoft security architects Abhilasha Bhargav-Spantzel and Pushkar Saraf.

  • The Anatomy of Criminal Failure: Analyzing OpSec Flaws in Major Takedowns

    RSA Conference 2026 · 2026-03-23 · San Francisco, CA, USA

    An in-depth analysis of operational security failures that led to the takedown of major cybercriminal operations, examining the mistakes that ultimately exposed threat actors to law enforcement.

  • Vibe Hunting: Turning AI Coding Agents into Autonomous Vulnerability Researchers

    RootedCON Madrid 2026 · 2026-03 · Madrid, Spain

    How AI coding agents can be turned into autonomous vulnerability researchers, exploring the offensive potential of vibe-driven AI workflows for security research.

  • The Dark Side Of LLMs

    BSidesTLV AI Hacking Village · 2025-12-11 · Tel Aviv, Israel

    An exploration of the security implications and potential threats posed by Large Language Models, examining attack vectors, vulnerabilities, and defensive strategies in the evolving AI landscape.

  • The Dark Mirror of LLMs

    APAC Partner Summit · 2025-09-15 · Bangkok, Thailand

    Presentation exploring the darker applications of Large Language Models, examining how AI can be weaponized by adversaries and what organizations need to know to protect themselves.

  • The Black Mirror of LLMs: How AI Powers the Adversary

    HackAPrompt Webinar · 2025-07-28

    Online session examining how adversaries leverage AI and Large Language Models to enhance their attack capabilities, with real-world examples and defensive strategies.

  • 2025 Cato CTRL™ Threat Report

    Cato Networks APJ Customer & Partner Event · 2025-05-20 · Tokyo, Japan

    Presentation of the 2025 Cato CTRL Threat Report to customers and partners across the APJ region, covering the latest threat intelligence and security trends.

  • From Assistants to Adversaries: The LLM Threat Landscape

    Qubit 2025 Conference · 2025-05-15 · Prague, Czech Republic

    A deep dive into how Large Language Models are transforming the threat landscape, from AI-powered assistants to potential adversarial tools, and what security professionals need to know.

  • Skyfall - Threats in the Cloud

    Cato Networks x Porsche Event · 2024-11-15 · Stuttgart, Germany

    Exclusive presentation at the Porsche Museum covering cloud security threats and vulnerabilities, exploring how organizations can protect their cloud infrastructure.

  • Warning! Botnet Is In Your House…

    Botconf 2022 · 2022-04-26 · Nantes, France

    Research presentation on IoT botnets targeting home devices, examining infection vectors, command and control infrastructure, and the growing threat to consumer networks.

Writing (12)

Press coverage (65)

2026

2025

2022

2019

Syndicated coverage (6)