Project Zero’s Windows internals specialist. Still posting deep-dives into COM/DCOM, sandbox escapes, Windows logical EoP, and tooling (OleView.NET). Wrote the Windows Security Internals book (2024). His sandbox-attacksurface-analysis-tools repo is essential for anyone auditing Windows.

French offensive security firm with one of the best public research feeds going right now. Pwn2Own regulars — VMware escape, router 0-days, iOS bugs. Recent posts cover NTLM reflection revival (CVE-2025-33073), heap exploitation on Windows 11 LFH, and ICS pen-test findings. Prolific and rigorous.

Singapore-based vuln research team, consistent Pwn2Own competitors. Blog covers full exploit chains — Cisco RCE via pickle deserialization, Samsung image parser bugs, Windows kernel EoP. Unusually transparent about failure and process; their year-end posts are worth reading for the craft perspective alone.

Still posting — less frequently now, but every post introduces a new class-level primitive. Chains “unexploitable” issues into full RCE; invented SSRF-to-metadata attack patterns, broke GitLab/GitHub CI with creative parser inconsistencies. His DEVCORE blog (devco.re) also worth following.

Malware analyst, pe-sieve and hollows_hunter author. Continues publishing PE internals deep-dives, process injection technique breakdowns, and new tooling via GitHub. The best free reference in malware analysis and Windows binary internals — and she keeps shipping.

Google security engineer, Dragon Sector CTF. Still streams security challenges live on YouTube and posts writeups. Covers a rare range — parsing bugs, network protocol edge cases, Python internals — with a rigorous, near-academic clarity you won’t find many places.

Created AFL, wrote The Tangled Web. Now at a16z, no longer actively posting security research — but the old writing fundamentally rewires how you think about bug classes and tooling design. His Substack occasionally covers adjacent tech thinking. Read the archives first.

Last substantial post 2021. OPSEC and tradecraft philosopher — how threat actors actually behave, where attribution goes wrong, what defenders misunderstand conceptually. The ideas haven’t aged badly. Read as a mental model foundation, not a current feed.

Project Zero legend — AV engine bugs, Windows subsystem 0-days, password manager research. Went quieter on public blog output in recent years but his Project Zero posts and GitHub repos remain among the best illustrations of creative audit scope. His bug reports read like essays.

Hardware security researcher and educator — JTAG exploitation, supply chain attacks, implant design. Blog updates are sparse now but the training material and older posts are still the best entry point into hardware offensive security. Worth the dive given any fintech/embedded surface exposure.