sondt / Thai Son Dinh

security researcher

I build tooling that hunts for vulnerabilities at scale, then verify and report what it finds. 121 CVEs so far, across 73 open-source projects.

• ARES, the Zeroday Machine - from target to CVE, autonomously. Black Hat India 2026, Bengaluru. With Dr. Quynh Nguyen Anh.
• BindSight, the Fuzzing Machine - from debug port to zero-days. Black Hat MEA 2026.
• No Human Found These Bugs - AI has entered the 0-day hunt. BSides Hanoi 2026, recording.

nezhaPraisonAIorg.hl7.fhir.coremcp-atlassiansurrealdbpypdfnodemaileronionshareModSecuritynettyPhpSpreadsheettornadonovucentrifugo9router

• blog - CTF writeups: reverse engineering, pwn, forensics. Most recent is FLARE-On 13.
• modern kernel exploitation - a 31-lesson course on Linux kernel exploitation, built from Cherie-Anne Lee's GCC 2025 deck.

Mail is on the contact page. If you maintain something I filed against and the report was unclear, say so and I will rewrite it.