Kirill Firsov

@k_firsov

Co-founder and CTO of @FearsOff | Protecting the World’s Top Crypto Exchanges & Financial Institutions | Cybersecurity Enthusiast

Dubai, United Arab Emirates

Joined April 2011

Pinned
Kirill Firsov
@k_firsov
Jul 21
Original write-up on the fastjson 1.2.83 gadget-free RCE. Have fun reading, I hope you missed writeups without AI slop. Comment here your opinion. fearsoff.org/research/fastj…
Kirill Firsov
@k_firsov
Aug 12
Today I filed a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) against HackerOne B.V.
Kirill Firsov
@k_firsov
Aug 11
I am #1 on many bug bounty programs in crypto. Including Binance, Bybit, Upbit, Kucoin, OKX and more. Occasionally we have had several clients who use a 3rd party app within their main tools. We found several RCEs in something that is being used by several top crypto projects,
Kirill Firsov
@k_firsov
Jul 29
This is huge. We already reproduced it. I like the CVE number CVE-2026-66066, a helluva bug!
André Baptista
@0xacb
Jul 29
🚨We reported KindaRails2Shell, a critical RCE in Ruby on Rails via Active Storage. It’s not a one-shot RCE, but the preconditions are kinda common under default configurations. Patch your applications now! ethiack.com/info-hub/resea…
Kirill Firsov
@k_firsov
Jul 29
Alibaba just released fastjson 1.2.84 on the archived project github.com/alibaba/fastjs…
Kirill Firsov
@k_firsov
Jul 21
Original write-up on the fastjson 1.2.83 gadget-free RCE. Have fun reading, I hope you missed writeups without AI slop. Comment here your opinion. fearsoff.org/research/fastj…