Hello,

I write blog posts which are mostly related to computer security. Currently, I’m living in Berlin, Germany.

Research interests

  1. Finding and analyzing software security vulnerabilities.
  2. Software robustness testing, including fuzzing and related techniques, through OneFuzzyWay.
  3. Programming and security-tool development.

Projects

  1. Eren: Reachability Triage for Fuzz Harnesses vs. Production Routes
  2. Padding Oracle Demo
  3. Designing Downgrader from LTE GRC Block for UHDs
  4. EMP Generator Circuit on PCB
  5. KOU OBS iOS Mobile Application
  6. Simple Link Shortener

Other

  1. Former core member at CanYouPwn.Me
  2. Former member of the WeedSquad CTF team
  3. Python for Hackers Instructor at PwnlyDays
  4. OSCP, OSCE, and Google Cloud Professional Cloud Security Engineer certifications
Bug Bounty & Security Research Acknowledgments Memory Safety Vulnerability Research
  1. 35𝒕𝒉 and 92𝒕𝒉 (Nickname: Arif Isik) on Microsoft Security Response Center's Top 100 Security Researchers of 2018. Attended BlueHat18 invite-only conference in Microsoft's Headquarters, Seattle
  2. OpenAI (Duplicate)
  3. CVE-2017-8758: Microsoft Exchange Server Elevation of Privilege Vulnerability - Allowed to obtain victim's data on Outlook Web Access by sending crafted emails even it is not opened by the victim. PoC Video. More detailed PoC Video is available upon request.
  4. Oracle - (6 bugs in same Critical Patch Update)
  5. Google
  6. Apple - 2017 and 2018
  7. Several bugs of Microsoft's products and online services. (Since 2016) 1, 2
  8. Mail.Ru and Pentagon
  9. Geeks for Geeks
  10. CERT-EU
  11. IT Department of Kocaeli University 1, 2
  12. Some private programs from several platforms and direct-invites from some of big companies
  1. Apple APFS (out-of-bounds write, Target Flag Captured) - CVE-2026-84523
  2. Multiple Apple Kernel Vulnerability Reports - Acknowledgment - September 2026
  3. Apple macOS HFS+ (XNU kernel out-of-bounds read with disk-write primitive) - CVE-2026-43773
  4. Apple macOS mDNSResponder (out-of-bounds write) - CVE-2026-43806
  5. Apple macOS xar vulnerability - 2026
  6. Apple macOS PPP (out-of-bounds read) - 2026 - macOS Tahoe 26.5, macOS Golden Gate 27
  7. Null pointer dereference in Oracle VM VirtualBox, Ticket, PoC.cpp
  8. Google Chromium remote heap memory corruption, Exploit-DB
  9. Memory corruption (access violation) in Zoom for Windows (2021). Fixed and rewarded by the vendor.
  10. Two vulnerabilities in MIT Kerberos (krb5). Advisory
  11. Multiple bugs in Vim Editor (Written in C).
  12. Multiple bugs in tsMuxer which is used by Universal Media Server (https://www.universalmediaserver.com/about/) internally - Most starred transport stream muxer project on Github (Written in C++).
  13. Multiple bugs in ffjpeg project.