Offensive Security Researcher — Apple Platforms

Paris, Île-de-France

mail  •  blog.reversesociety.co  •  linkedin  •  @tonygo_

I do vulnerability research and reverse engineering on Apple platforms: macOS and iOS internals, sandbox boundaries, XPC, Mach-O. Credited by Apple for a sandbox escape in App Intents (CVE-2026-28995) and for assistance on WebKit.

Eight years as a systems engineer came first: C, C++ and Objective-C runtimes, native API layers, JavaScript engine internals. I understand the code I'm attacking because I've shipped code exactly like it.

CVE-2026-28995 — App Intents sandbox escape

Impact: A malicious app may be able to break out of its sandbox Description: A logic issue was addressed with improved restrictions. Credit: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society

Fixed across iOS & iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5 and iOS & iPadOS 18.7.9.

Apple acknowledgment — WebKit, iOS & iPadOS 26.6 and macOS Tahoe 26.6 Listed under Additional recognition for assistance with WebKit.

snixpc — XPC sniffer built on LLDB Instruments XPC traffic on macOS to make an otherwise opaque IPC surface observable.

macho_re — Mach-O parsing library in C Handles single-architecture and fat (universal) binaries, x86 / x86_64 / ARM / ARM64, dylibs, executables and core dumps, dynamic libraries, and strings resolved to their owning segments and sections. Started as an experiment to learn the format properly rather than read someone else's parser.

js-x-ray (NodeSecure) — JavaScript malware detection Static analysis of open-source packages. Contributed a suspicious-command probe flagging dangerous spawn / exec usage.

macos-lldb-reverse-engineering — RE exercise binaries XPCDemo · TestES — XPC and EndpointSecurity experiments antidebug-examples — anti-debugging techniques via fork

blog.reversesociety.co — macOS and iOS internals through reverse engineering and practical experiment. Publishing since December 2022.

Analysis · Binary Ninja · LLDB · Frida · Instruments Languages · C · C++ · Objective-C · Swift · Rust · TypeScript Areas · Reverse engineering · macOS/iOS internals · Vulnerability research · Static analysis · XPC · Mach-O

The foundation underneath the security work — and what funds it.

Holepunch — Systems Engineer, freelance (2025–present) iOS and Android systems work across the Bare runtime ecosystem — native modules and platform bindings. Top contributor to bare-ffmpeg; also bare-kit, bare-sdl, bare-media, bare-bluetooth and bare-android. This consulting is what funds the research above.

Postman — Senior Systems Engineer (2023–2025) Led all Apple platform development (C++, Objective-C, Swift) and shaped cross-OS architecture. Wrapped native Objective-C, Linux and Win32 APIs into a unified C++ layer, then bridged it to JavaScript through JavaScriptCore.

Node.js — Collaborator (2022–present) Diagnostics and Single Executable working groups.

PayFit — Software Engineer (2020–2021) Built a static analysis service over a payroll DSL used by 100+ engineers — dependency graphs and strongly connected components.

_{Open to offensive security research roles. Remote.}