Pwn2Own Ireland 2026: Two Phones, Two Successful Exploits, and Third Place
Last week, I traveled to Ireland to compete in Pwn2Own Ireland 2026. I teamed up with Dimitrios and Tenia Valsamara...
Read More →
Blog
Blogs
Explore Our Blog to Find Your Unique Interests! Browse
our blog for fresh ideas that align with
Explore Our Blog to Find Your Unique Interests!
Browse our blog for fresh ideas that align with your interests.
Free Djini AI SAST: Now Fixes What It Finds
Our AI source-code scanner now brings the next step into GitHub: automated fixes, issues and pull requests. Connect your Android...
Read More →
Djini AI SAST: A Free AI Scanner for Mobile App Source Code
Today we are releasing Djini AI SAST, a new scanner that finds security bugs in mobile app source code....
Read More →
Hacking Optimus Prime: One Click to RCE on the TECNO Spark 30 Pro
August 25, 2026 Ken Gannon No Comments Story Time In 2024, I bought an officially licensed Transformers Optimus Prime mobile...
Read More →
Pwn2Own 2025 – Part 1: Samsung Members WebView Takeover & Intent Redirection (CVE-2025-21079)
August 13, 2026 Ken Gannon No Comments Product Samsung Members (com.samsung.android.voc) Affected versions Confirmed exploitable on 5.5.00.13 Fixed in 5.5.01.3...
Read More →
Technical Advisory – Meta Horizon Shell — Automatic Dangerous Permission Grant via Virtual Input Injection
August 10, 2026 Ken Gannon No Comments Note to the Reader This vulnerability was identified during security research supported by...
Read More →
Technical Advisory – Samsung Dressroom (Wallpaper & Style) – Arbitrary File Write at System UID
Ken Gannon July 30, 2026 12:41 pm No Comments Product Wallpaper & Style / Dressroom (com.samsung.android.app.dressroom) Affected versions Confirmed exploitable...
Read More →
Technical Advisory – Meta Quest System-Wide DoS via Unprotected Memory
Product Meta Quest System Resource (com.oculus.systemresource) Affected versions 201.0.0.129.1682 and below (the v201 OS train) Fixed in vros 204 —...
Read More →
OAuth in Mobile Apps: How Custom Schemes can leak Your Tokens
OAuth 2.0: The Protocol OAuth 2.0 solves a delegation problem: how can a third-party application access resources on your...
Read More →
Detecting and Exploiting Insecure Deserialization with Djini.AI
See how Djini.AI automatically scanned an Android app with 16M downloads, verified a deserialization vulnerability, and developed a working RCE...
Read More →
Intro to Intent redirections…and how to exploit them
Android Intents are the core messaging system that allows components to talk to each other — whether that’s within the...
Read More →
Unlimited Mobile Security Testing, Directly From Your AI Agent
Any AI agent that supports A2A can now discover Djini, connect to it, and run mobile security scans — all...
Read More →
1-Click ATO: A studycase of common Android apps misconfigurations.
Summary A while ago, i found a chain of bugs in one app that led to a 1-Click Account Takeover....
Read More →
Automated API Security Testing for Mobile Backends
Your mobile apps talk to backend APIs that handle credentials, personal data, and payment information. Djini's HTTP Traffic Audit automatically...
Read More →
Unauthorized Device Command and Control
How an Exported Activity processed untrusted Intent extras without validation, allowing malicious application to trigger device actions.
Read More →
Intro to Android WebViews and deep links…and how to exploit them
Android WebView is a system component that allows applications to render web content directly inside a native app, and it...
Read More →
Very interesting bug chain, especially the escalation process by using AppLink as a bridge between the browser and the app…