Vitaly Simonovich

Security Researcher

Vulnerability Research · Threat Intelligence · AI Security

Senior security researcher working across vulnerability research, threat intelligence, and AI security. I break systems the way real attackers do, from core internet infrastructure like DNS and glibc to browsers, web platforms, and LLMs, and turn those findings into practical defenses, threat reports, and education so organizations can stay ahead of attackers.

githublinkedinxRemote, available worldwide

Last updated: October 27, 2026

At a glance

  • 10+Years Experience
  • 30CVEs Discovered
  • 12Public Speaking
  • 75+Press Mentions

Areas of expertise

  • Vulnerability Research
  • Threat Intelligence
  • LLM & GenAI Security
  • Jailbreaks & Prompt Injection
  • Application Security
  • Data Security
  • Offensive Security & CTFs
  • Security Education & Public Speaking

Highlights

  • DEF CON 34 Main Track

    C(2)YA: Inside the Adversary's Inbox — six months of LLM-assisted research against five C2 frameworks (Havoc, Mythic, Sliver, Covenant, AdaptixC2) yielding 251 findings, 85 exploitable straight from the internet, and 28 takedown chains.

  • Cited by the UK AI Security Institute

    Nytheon AI research cited by name in reference 26 of AISI's Frontier AI Trends Report, published on 18 December 2025.

  • HashJack Research

    First known indirect prompt injection technique weaponizing URL fragments to manipulate AI browser assistants. Covered by Forbes, The Register, and The Hacker News.

  • Apple WebKit Vulnerabilities

    Three flaws in Apple WebKit (CVE-2026-28917, CVE-2026-28962, CVE-2026-43700): a memory-safety crash, an information disclosure issue, and a cross-origin leak of sensitive user data.

  • NVIDIA TensorRT-LLM Vulnerabilities

    Two flaws in NVIDIA's LLM inference engine (CVE-2026-24226, CVE-2026-24234): improper control of code generation, and a server-side request forgery in multimodal media fetching.

  • Operation Poisson

    A 33-day French-speaking cybercrime operation captured command-by-command, revealing how a junior operator used Tailscale and OpenSSH to keep access after his C2 went offline. Covered by The Hacker News.

  • MongoDB Hall of Fame

    Pre-authentication denial of service in MongoDB Server (CVE-2026-25611, High severity) and induction into the MongoDB Security Researcher Hall of Fame.

  • Core Infrastructure CVEs

    A 2026 run of vulnerability discoveries across core infrastructure: BIND 9, PowerDNS, Jenkins, Apache Log4j, WordPress, Zabbix, and Google Chrome.

CVEs discovered (30)

12 High · 14 Medium · 4 Low.

CVEVendorSeveritySummary
CVE-2026-85557PowerDNSMediumRecursor HTTPS web interface denial of service. Denial of service in the PowerDNS Recursor internal HTTPS web interface when incoming TLS is enabled, which is off by default. PowerDNS credits Vitaly Simonovich for reporting the issue (CVSS 3.1: 5.3). Affects Recursor versions up to and including 5.3.11 and 5.4.7; fixed in 5.3.12 and 5.4.8.Disclosed 2026-10-21
CVE-2026-1199ZabbixMediumLogin lockout race condition. Race condition in the Zabbix Frontend and API login lockout mechanism, where simultaneous failed login requests are not all counted towards the block counter, letting an attacker make more password guesses than the lockout is meant to allow. Affects 6.0.0–6.0.46, 7.0.0–7.0.27 and 7.4.0–7.4.11; fixed in 6.0.47, 7.0.28 and 7.4.12.
CVE-2026-24234NVIDIAMediumTensorRT-LLM multimodal SSRF. Server-side request forgery in the multimodal media fetching functions of NVIDIA TensorRT-LLM for Linux, where a network-accessible attacker can steer the inference server into issuing attacker-controlled requests, leading to information disclosure and denial of service. Affects TensorRT-LLM through v1.3.0 rc16.
CVE-2026-24226NVIDIAMediumTensorRT-LLM improper control of code generation. Improper control of code generation in NVIDIA TensorRT-LLM for Linux, where functionality is included from an untrusted control sphere; a successful exploit can lead to code execution, data tampering, and information disclosure. Affects TensorRT-LLM through v1.3.0 rc12.
CVE-2026-48936Node.jsLowPermission model network bypass via Unix socket. Incomplete fix for CVE-2026-21636 in the Node.js Permission Model: a local server can be started over a Unix domain socket without the --allow-net permission, bypassing the intended network restrictions. Affects Node.js 26; fixed in 26.3.1.
CVE-2026-55827FreeRDPHighRemoteFX heap buffer overflow. Heap buffer overflow in FreeRDP where the GDI layer passes desktop surface dimensions instead of bitmap dimensions as write bounds to the RemoteFX decoder, letting a malicious RDP server write past the allocated bitmap buffer with attacker-influenced content and potentially hijack execution. Affects 2.0.0 through 2.11.7 and 3.0.0 through 3.27.0; fixed in 3.27.1.
CVE-2026-55564FreeRDPMediumGlyph cache out-of-bounds read. Off-by-one error in FreeRDP's glyph_cache_get() bounds check lets a malicious RDP server trigger an out-of-bounds heap read via crafted glyph fragments, dereferencing one slot past the glyph cache array and potentially causing denial of service or information disclosure. Affects versions up to 3.26.0; fixed in 3.27.0.
CVE-2026-28917Apple WebKitMediumMemory-safety process crash. Memory-safety issue in Apple WebKit where processing maliciously crafted web content can cause an unexpected process crash (denial of service). Fixed in Safari 26.5 on macOS Sonoma and macOS Sequoia.
CVE-2026-28962Apple WebKitMediumInformation disclosure. Information disclosure vulnerability in Apple WebKit where processing maliciously crafted web content may reveal sensitive user information. Fixed in Safari 26.5 on macOS Sonoma and macOS Sequoia.
CVE-2026-43700Apple WebKitMediumCross-origin information disclosure. Cross-origin issue in Apple WebKit where security origins were not tracked correctly, letting maliciously crafted web content disclose sensitive user information across origin boundaries. Fixed in Safari, iOS, iPadOS and macOS 26.5.2, and in tvOS, watchOS and visionOS 26.6.
CVE-2026-5913Google ChromeLowOut-of-bounds read in Blink. Out-of-bounds read in the Blink rendering engine in Google Chrome prior to 147.0.7727.55 allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Affects Chrome on Windows, Linux, and macOS.
CVE-2026-33608PowerDNSHighBackend DoS via crafted NOTIFY. Incomplete domain name sanitization during Bind autosecondary zone transfer in PowerDNS Authoritative Server allows an attacker to send a notify request causing a secondary domain to be added with invalid configuration, rendering the Bind backend inoperable after restart. Affects versions up to 5.0.3 and 4.9.13.
CVE-2026-33257PowerDNSMediumWebserver memory exhaustion. Insufficient input validation of the internal webserver in PowerDNS Authoritative Server and DNSdist allows an unauthenticated attacker to send crafted HTTP requests causing unlimited memory allocation and denial of service. Requires the web server feature to be enabled. Affects PowerDNS Authoritative 3.4.0–5.0.3 and DNSdist up to 2.0.3.
CVE-2026-42390PowerDNSMediumRecursor ZONEMD validation bypass. ZONEMD verification bypass in the PowerDNS Recursor: the digest compare loop does not re-check scheme eligibility, so a zone carrying a reserved scheme=0 ZONEMD record with the correct digest passes validation even when the eligible record's digest is wrong. Relevant when Zone-to-Cache is configured with zonemd: require. Affects Recursor 5.4.0 through 5.4.2; fixed in 5.4.3.
CVE-2026-42004PowerDNSLowDNSdist EDNS options smuggling. EDNS options smuggling in PowerDNS DNSdist: a crafted EDNS OPT record is ignored by DNSdist's filtering rules but rewritten as a valid OPT record when EDNS Client Subnet is inserted, so the backend receives EDNS options that DNSdist did not filter. Affects DNSdist up to 1.9.14 and 2.0.6; fixed in 1.9.15 and 2.0.7.
CVE-2026-3104ISC BIND 9HighResolver memory leak DoS. Memory leak in BIND 9 resolvers triggered by specially crafted domain queries, causing denial of service through resource exhaustion. Affects BIND 9.20.0–9.20.20 and 9.21.0–9.21.19.
CVE-2026-3119ISC BIND 9MediumCrash via TKEY query. Authenticated query containing a TKEY record with a valid TSIG can cause the BIND named daemon to terminate unexpectedly. Affects BIND 9.20.0–9.20.20 and 9.21.0–9.21.19.
CVE-2026-77692ISC BIND 9HighUnauthenticated remote crash via DoH SIG(0) request. NULL pointer dereference in BIND 9 reachable with no authentication: a single DNS-over-HTTPS request carrying a cryptographically invalid SIG(0) record, followed by an abrupt close of the transport connection, crashes the named daemon. No workarounds are available. Affects 9.20.0–9.20.27, 9.21.0–9.21.25 and Supported Preview 9.20.9-S1–9.20.27-S1; fixed in 9.20.29, 9.21.26 and 9.20.29-S1.
CVE-2026-33001JenkinsHighArbitrary file write via symlinks. Link following vulnerability in Jenkins 2.554 and earlier, LTS 2.541.2 and earlier allows crafted .tar and .tar.gz archives to write files to arbitrary locations via symbolic links, enabling code execution by attackers with Item/Configure permission or control of agent processes.
CVE-2026-25611MongoDBHighPre-auth memory exhaustion DoS. Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server. A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.
CVE-2025-15281glibcHighUse-after-free in wordexp(). Use-After-Free vulnerability in glibc's wordexp() function when using WRDE_REUSE and WRDE_APPEND flags, allowing memory corruption and potential code execution via uninitialized memory access.
CVE-2026-0859TYPO3MediumInsecure deserialization in mailer. Insecure Deserialization vulnerability in TYPO3 CMS Mailer file spool allowing local users with write access to the spool directory to inject and execute arbitrary PHP code via crafted serialized files.
CVE-2026-49740TYPO3MediumInsecure deserialization in Core API. Insecure deserialization in the TYPO3 CMS Core API (ext:core) where crafted serialized data can affect downstream components. Fixed across TYPO3 13.4.31 LTS, 14.3.3 LTS, and ELTS releases.
CVE-2025-67849MoodleHighStored XSS in AI Course Assist. Stored Cross-Site Scripting (XSS) vulnerability in Moodle's AI Course Assist via unsanitized HTML rendering in the response template, allowing authenticated users to execute arbitrary JavaScript and steal session tokens.
CVE-2025-64496Open WebUIHighCode injection via SSE. Code Injection vulnerability in Open WebUI via Server-Sent Events (SSE) in Direct Connections feature, allowing malicious external model servers to execute arbitrary JavaScript and steal authentication tokens.
CVE-2025-52670Revive AdserverHighAuthorization bypass (IDOR). Authorization Bypass (IDOR) vulnerability in Revive Adserver allowing authenticated users to delete banners owned by other accounts via improper ownership validation.
CVE-2025-52668Revive AdserverHighStored XSS. Stored Cross-Site Scripting (XSS) vulnerability in Revive Adserver's statistics-conversions.php script via tracker or campaign names, enabling session hijacking and information disclosure.
CVE-2026-3039ISC BIND 9HighGSS-API TKEY memory exhaustion. Excessive memory consumption during GSS-API TKEY negotiation can cause denial of service in BIND 9 deployments using TKEY-based authentication. ISC credits Vitaly Simonovich for the report. Fixed in 9.18.49, 9.20.23 and 9.21.22.Disclosed 2026-05-20
CVE-2026-34477Apache Log4jMediumTLS hostname verification configuration ignored. Log4j Core silently ignores the verifyHostName attribute in TLS configuration for affected appenders, permitting interception of log traffic under the conditions described by Apache. Vitaly Simonovich is credited as an independent reporter alongside other researchers. Fixed in 2.25.4.
CVE-2026-70430JenkinsLowOverall/Manage configuration type restriction bypass. Users with Overall/Manage permission can instantiate configuration-related object types intended for administrators through the project naming strategy configuration. Jenkins credits Vitaly Simonovich for SECURITY-3916. Fixed in Jenkins 2.576 and LTS 2.568.2.Disclosed 2026-08-05

Awards & recognition (12)

  • Security Advisory Credit, PowerDNS (2026)

    Credited in PowerDNS Security Advisory 2026-12 for reporting CVE-2026-85557, a Medium-severity denial-of-service issue in the Recursor internal HTTPS web interface, disclosed on 21 October 2026.

  • Security Advisory Credit, Apache Logging Services (2026)

    Credited as an independent reporter of CVE-2026-34477 in Apache Log4j Core, a TLS hostname-verification configuration issue, alongside other researchers.

  • Security Advisory Credit, Zabbix (2026)

    Credited for reporting a login lockout race condition in the Zabbix Frontend and API, disclosed through the HackerOne bug bounty program.

  • Security Research Acknowledgement, Apple (2026)

    Recognized in Apple's security advisories for WebKit and WebKit Storage research, alongside credited WebKit vulnerabilities.

  • Product Security Acknowledgement, NVIDIA (2026)

    Credited on NVIDIA's Product Security Acknowledgements page for reporting two vulnerabilities in TensorRT-LLM.

  • Security Vulnerability Credit, WordPress (2026)

    Credited for reporting an AJAX query-attachments authorization bypass, fixed in WordPress 6.9.2.

  • Security Vulnerability Credit, ISC (BIND9) (2026)

    Credited across BIND 9 security advisories for DNSSEC proof preparation, TKEY query handling, GSS-API TKEY memory exhaustion (CVE-2026-3039), and a DNS-over-HTTPS crash, alongside QP-trie cache research.

  • Security Advisory Credit, Jenkins (2026)

    Credited for independent discovery of the Jenkins link-following vulnerability (CVE-2026-33001) and for the Overall/Manage configuration type restriction bypass (CVE-2026-70430), reported through the Jenkins Bug Bounty Program sponsored by the European Commission.

    March 2026 advisoryAugust 2026 advisory

  • Security Researcher Hall of Fame, MongoDB (2026)

    Recognized for responsibly disclosing a security vulnerability in MongoDB products.

  • Frontier AI Trends Report Citation, UK AI Security Institute (AISI) (2025)

    Cited by name in reference 26 of AISI's Frontier AI Trends Report, published on 18 December 2025, for Cato CTRL research uncovering Nytheon AI, a platform of uncensored LLMs.

  • AI Safety - Immersive world jailbreak, Microsoft (2025)

    Awarded for discovering the 'Immersive world' jailbreak in Microsoft's copilot.

  • AI Security - Edge browser prompt injection, Microsoft (2025)

    Indirect prompt injection vulnerability found in Microsoft's edge browser.

Research (21)

Citations & acknowledgments (18)

Academic and technical citations, distribution acknowledgments, and partner content.

  • Open Technical Problems in Open-Weight AI Model Risk Management

    Transactions on Machine Learning Research / arXiv · 2026 · Academic citation

    Cites Vitaly Simonovich’s Nytheon AI research in its discussion of open-weight models adapted for harmful uses.

    Section 2 and bibliography

  • ChatGPhish: When the AI Assistant Becomes the Phishing Vector

    Cloud Security Alliance · 2026-05-31 · Technical research reference

    CSA AI Safety Initiative research note on prompt-injection phishing that credits Cato CTRL's HashJack in its comparison of indirect prompt injection techniques.

  • USN-8293-1: Bind vulnerabilities

    Ubuntu / Canonical · 2026-05-21 · Distribution acknowledgment

    Ubuntu’s security notice names Vitaly Simonovich as the discoverer of CVE-2026-3039, the BIND 9 GSS-API TKEY memory-exhaustion vulnerability. This is a downstream acknowledgment of the same ISC disclosure.

  • LAMEHUG, Software S9035

    MITRE ATT&CK · Created 2026-04-21 · Threat knowledge base

    The LAMEHUG software entry cites Vitaly Simonovich’s Cato CTRL analysis in its APT28 attribution and technique mapping.

    Software S9035, reference 3

  • AI Browser Extensions: Shadow AI’s Hidden Attack Surface

    Cloud Security Alliance · 2026-04-10 · Technical research reference

    CSA’s AI Safety Initiative research note references Cato CTRL’s HashJack research in its discussion of browser-extension risks.

    Reference 6

  • USN-8124-1: Bind vulnerabilities

    Ubuntu Security · 2026-03-25 · Distribution acknowledgment

    Ubuntu security notice crediting Vitaly Simonovich for discovering the ISC BIND vulnerabilities he reported (CVE-2026-3104 and CVE-2026-3119).

  • Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild

    Unit 42 (Palo Alto Networks) · 2026-03-03 · Technical research reference

    Palo Alto Networks Unit 42 analysis of web-based indirect prompt injection seen in the wild, citing Cato CTRL's HashJack technique.

  • Frontier AI Trends Report

    UK AI Security Institute (AISI) · 2025-12-18 · Policy report citation

    The UK AI Security Institute's inaugural Frontier AI Trends Report cites Vitaly Simonovich by name in reference 26 for his Cato CTRL research on Nytheon AI, a platform of uncensored LLMs.

  • APT28 Cyber Threat Profile and Detailed TTPs

    Picus Security · Updated 2025-12-10 · Technical research reference

    Picus’s APT28 threat profile cites Vitaly Simonovich’s LAMEHUG analysis as reference 8.

    Reference 8

  • HashJack Attack Targets AI Browsers and Agentic AI Systems

    F5 Labs · 2025-12-05 · Technical research reference

    Technical analysis of HashJack vulnerability with enterprise security recommendations for AI agents and agentic systems.

  • CS 419: Computer Security, authentication lecture slides

    Rutgers University — CS 419 · 2025-09-29 · Teaching reference

    Paul Krzyzanowski’s authentication lecture uses coverage of Vitaly Simonovich’s Immersive World research as an AI security example.

    Slide 59

  • Tipping the Scales: Emerging AI Capabilities and the Cyber Offense-Defense Balance

    Center for a New American Security · 2025-09-23 · Policy report citation

    Caleb Withers’s report cites Vitaly Simonovich’s LAMEHUG analysis in its discussion of AI capabilities and cyber offense and defense.

    Endnote 43

  • From Misuse to Abuse: AI Risks and Attacks

    The Hacker News · 2024-10-16 · Partner content

    Partner content featuring Vitaly Simonovich’s commentary on AI risks and attacks. The page’s byline is The Hacker News; this is recorded as participation rather than personal authorship or independent reporting.

  • Neural networks based domain name generation

    Journal of Information Security and Applications / Elsevier · 2021-09-01 · Academic citation

    Journal article by Zheng Wang and Yang Guo that includes a reference to Vitaly Simonovich’s research. NIST provides the publication metadata.

    Bibliography

    Publisher citation listing

  • Intrusion Detection System for IoT Networks for Detection of DDoS Attacks

    Newcastle University · 2021-02 · Academic citation

    Monika Roopak’s doctoral thesis cites Vitaly Simonovich’s Imperva application-layer DDoS research.

    Reference 10

  • Application-Layer DDoS Defense with Reinforcement Learning

    IEEE/ACM IWQoS · 2020 · Academic citation

    Cites Vitaly Simonovich’s Imperva research on a 13-day, 292,000 requests-per-second application-layer DDoS attack.

    Reference 3

  • An Anomaly Mitigation Framework for IoT Using Fog Computing

    Electronics / UEA Digital Repository · 2020-09-24 · Academic citation

    Cites Vitaly Simonovich’s Imperva application-layer DDoS research as background for IoT anomaly mitigation.

    Reference 6

  • LAMEHUG malware-family entry

    Fraunhofer FKIE / Malpedia · Undated · Threat knowledge base

    Malpedia’s LAMEHUG entry lists Vitaly Simonovich by name and links his Cato CTRL analysis in its references.

    References

Speaking (12)

  • C(2)YA: Inside the Adversary's Inbox

    DEF CON 34 · 2026-08-08 · Las Vegas, NV, USA

    Six months of LLM-assisted research against five C2 frameworks — Havoc, Mythic, Sliver, Covenant and AdaptixC2 — surfacing 251 design flaws and vulnerabilities, 85 of them exploitable from the internet with no prior access, plus 28 takedown chains and crypto failures that decrypt all C2 traffic from a single recovered key.

  • HashJack: Exploiting URL Fragments to Hijack AI Browser Assistants

    Ekoparty Security Conference · 2026-05-22 · Miami, FL, USA

    An indirect prompt injection technique that hides malicious instructions in URL fragments to hijack AI browser assistants, with real attack scenarios and defensive guidance.

  • Agentic Security: Past, Present, and Future

    SASEfy 2026 · 2026-05 · Virtual

    A panel on the past, present, and future of agentic AI security, presented with Cato CTRL's Etay Maor and Microsoft security architects Abhilasha Bhargav-Spantzel and Pushkar Saraf.

  • The Anatomy of Criminal Failure: Analyzing OpSec Flaws in Major Takedowns

    RSA Conference 2026 · 2026-03-23 · San Francisco, CA, USA

    An in-depth analysis of operational security failures that led to the takedown of major cybercriminal operations, examining the mistakes that ultimately exposed threat actors to law enforcement.

  • Vibe Hunting: Turning AI Coding Agents into Autonomous Vulnerability Researchers

    RootedCON Madrid 2026 · 2026-03 · Madrid, Spain

    How AI coding agents can be turned into autonomous vulnerability researchers, exploring the offensive potential of vibe-driven AI workflows for security research.

  • The Dark Side Of LLMs

    BSidesTLV AI Hacking Village · 2025-12-11 · Tel Aviv, Israel

    An exploration of the security implications and potential threats posed by Large Language Models, examining attack vectors, vulnerabilities, and defensive strategies in the evolving AI landscape.

  • The Dark Mirror of LLMs

    APAC Partner Summit · 2025-09-15 · Bangkok, Thailand

    Presentation exploring the darker applications of Large Language Models, examining how AI can be weaponized by adversaries and what organizations need to know to protect themselves.

  • The Black Mirror of LLMs: How AI Powers the Adversary

    HackAPrompt Webinar · 2025-07-28

    Online session examining how adversaries leverage AI and Large Language Models to enhance their attack capabilities, with real-world examples and defensive strategies.

  • 2025 Cato CTRL™ Threat Report

    Cato Networks APJ Customer & Partner Event · 2025-05-20 · Tokyo, Japan

    Presentation of the 2025 Cato CTRL Threat Report to customers and partners across the APJ region, covering the latest threat intelligence and security trends.

  • From Assistants to Adversaries: The LLM Threat Landscape

    Qubit 2025 Conference · 2025-05-15 · Prague, Czech Republic

    A deep dive into how Large Language Models are transforming the threat landscape, from AI-powered assistants to potential adversarial tools, and what security professionals need to know.

  • Skyfall - Threats in the Cloud

    Cato Networks x Porsche Event · 2024-11-15 · Stuttgart, Germany

    Exclusive presentation at the Porsche Museum covering cloud security threats and vulnerabilities, exploring how organizations can protect their cloud infrastructure.

  • Warning! Botnet Is In Your House…

    Botconf 2022 · 2022-04-26 · Nantes, France

    Research presentation on IoT botnets targeting home devices, examining infection vectors, command and control infrastructure, and the growing threat to consumer networks.

Writing (12)

Press coverage (75)

2026

2025

2022

2021

2019

Syndicated coverage (11)