Offensive security / vulnerability research
Matthew
Zamat.
I find and document security flaws across applications, APIs, and device software.
Application Security Manager at OnDefend and independent researcher. My work spans access control, authentication, mobile systems, and Apple platforms.
Read the researchFeatured research / September 2026
A Bluetooth heap overflow in uarpd
A connected accessory supplied an update asset that made Apple's daemon copy 320 bytes into a 64-byte heap allocation. Apple fixed it as CVE-2026-86924.
Apple
Security acknowledgmentsView credits ↗HackerOne
Top 20 all-timeResearcher profile ↗Research notes
Writing
Technical accounts of findings, from the first clue through the impact and the fix.
CVE-2026-86938: DLL Hijacking in the FileMaker Pro Installer
A local user could place a DLL beside the Windows FileMaker Pro installer and have it run with administrator privileges. Claris fixed the issue in FileMaker Pro 26.0.3.
CVE-2026-86924: A Bluetooth Heap Overflow in uarpd
A malformed Bluetooth accessory update made uarpd copy five times more data than it allocated. Apple fixed the heap overflow and assigned CVE-2026-86924.
Two Dots to Admin: A $50K Account Takeover on Apple
A single encoded dot-dot slipped past the authorization check and let me read any account's private data with one request, then make myself an admin with another. Here is how the bug worked.
The work
About
I lead application penetration testing at OnDefend and pursue independent vulnerability research.
Most of my work is in web and API authorization, mobile applications, and Apple systems. Before moving into security, I worked in vaccine process development. I still approach research as an experiment: isolate the behavior, reproduce it, and report what the evidence shows.
Applications & APIs
Access control, authentication, business logic, and GraphQL.
Mobile & device software
iOS, macOS, Android, firmware, and protocol behavior.
Security tooling
Automation for wider coverage, with manual proof before a finding is reported.
Background
Experience
Selected roles. The full résumé has the details.