TGViewer
Channel Public Channel
Ilya Andr (@andrd3v)

Ilya Andr (@andrd3v)

@andrd3v

dm: @andrcoder
Open in Telegram
Subscribers
186
Photos
13
Videos
1
Links
13
Recent Posts 15 shown
Post #101 167

Forwarded from amfi

Спустя 3 месяцы борьбы с product security я все таки добился от них CVE.
Post #100 193
iOS and macOS 27.0 just dropped - and here are the CVEs I got credited for:

CVE-2026-43664
CVE-2026-65345
CVE-2026-86905
CVE-2026-84606
CVE-2026-84625
CVE-2026-84623
CVE-2026-86878

More details:
https://andrd3v.github.io/cves/index.html

P.S. kinda bummed tbh - I had 38 reports marked for a Fall 2026 fix, and only 7 landed in this release.
Post #95 390

Forwarded from amfi

Первая CVE осталось добиться от Apple чтобы указали в advisory (имя фамилию)
Post #94 334
👏👏
Post #93 510
Hey everyone! Need some advice. 😨

Has anyone from Russia successfully received payouts through App Store Connect recently 🇷🇺? Specifically - is the Paid Apps Agreement still available on Russian accounts, and can you set up banking with a foreign bank (Armenia/Georgia/Turkey)? Or do I need an account registered outside of Russia to accept the agreement?

If you have any experience with this, please DM me. 😃

DM: @andrcoder
Post #92 659
My friend doesn't waste time either!!
Post #91 600

Forwarded from iOSSec (Vladislav Shevchenko)

С днем security release! В этот список у меня залетела всего одна бага, так что ждем дальше 🫠

Кстати, залил райтапы, переделанные из отчетов, по CVE-2026-39868 и kernel VA leak (IOService::updateConsoleUsers) в репу на гитхабе.
Post #88 1.13K
+3 Acknowledgments
Post #87 735
New write-up: Detecting task_for_pid and pid_for_task via CS_INVALID_ALLOWED

TASK_EXTMOD_INFO only catches task_for_pid - the pid_for_task workaround walks right past it. Turns out XNU sets CS_INVALID_ALLOWED on the target process for both methods, and you can read it with a single csops() call from userspace.

Read: https://andrd3v.github.io/detecting-tfp
Source: https://github.com/andrd3v/tfp_and_pfd_detect
andrd3v.github.io Detecting task_for_pid and pid_for_task via CS_INVALID_ALLOWED — andrd3v Detect task_for_pid and pid_for_task workaround on macOS by checking CS_INVALID_ALLOWED code signing flag via csops(). Covers detection of both methods including Jonathan Levin's pid_for_task technique.
Post #74 870
Got my first CVE from Apple 🎉

CVE-2026-28882 - installed app and running process enumeration across iOS, macOS, watchOS, tvOS, visionOS.
Older posts →

About this channel

How can I read @andrd3v without a Telegram account?
TGViewer shows the public web preview Telegram publishes for Ilya Andr (@andrd3v): recent posts, photos, videos and the subscriber count, with no app, login or account.
How many subscribers does Ilya Andr (@andrd3v) have?
Ilya Andr (@andrd3v) (@andrd3v) has 186 subscribers on Telegram, refreshed roughly every 30 minutes.
Does Ilya Andr (@andrd3v) know I viewed it here?
No. Public channel previews carry no viewer identity, and TGViewer has no accounts or tracking of what you look up.
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →