Gabriele

Digregorio

also known as Io_no

I'm a Computer Engineer with a strong interest in cybersecurity and a PhD candidate at Politecnico di Milano. I play with the Tower of Hanoi and mhackeroni CTF teams, engaging in activities such as exploiting and reversing binaries, as well as evaluating the (software) security of machine learning systems. I am also a maintainer of the libdebug project.

Want to get in touch? Email me at gabriele.digregorio[at]polimi.it

CTFs

Member of mhackeroni since 2022.
Winners of Hack-A-Sat 4, the world's first CTF in space by the Air Force Research Laboratory.
Participated in DEF CON 31, 32, and 33 Finals.
Co-organizers of Ctrl+Space with challenges running on satellites orbiting Earth, in collaboration with ESA and D-Orbit.

Visit mhackeroni Visit Ctrl+Space

Member of Tower of Hanoi since 2021.
Team treasurer since 2024.
ToH CTF 2025 organizers.

Visit Tower of Hanoi

libdebug

Maintainer of libdebug, an open-source Python library to debug binary executables, your own way.

Visit libdebug

Bug Hunting

When I'm bored and not doing research, not playing (or organizing) CTFs, and not working on libdebug, I occasionally hunt down unknown vulnerabilities in widely used software.

So far, I've found vulnerabilities in Keras, Google Messages (on Wear OS), Android, skops, and Redis, which I reported through responsible disclosure to the respective vendors. Some were severe enough to earn bounties and get tracked as public CVE advisories. My findings have also been picked up by media such as Forbes, Android Authority, and Android Police.

Curious about my bug hunting? I've shared some of the reports I can make public on GitHub.

View Bug Reports

Writeups

Vulnerability

CVE-2025-12080 - Intent Abuse in Google Messages for Wear OS for Silent Message Sending

23 October 2025

CVE-2025-12080, which I discovered in March 2025 and for which I was later awarded a bounty by the Google Mobile VRP.

Vulnerability CTF

CVE-2025-9905 - Arbitrary Code Execution on Keras (once again) via Legacy Files

23 October 2025

CVE-2025-9905, which I discovered in June 2025. Exploiting this vulnerability was also the intended solution to the Intended Behaviour challenge I authored for ToH CTF 2025.

Vulnerability CTF

CVE-2025-1550 - Arbitrary Code Execution on Keras

20 July 2025

CVE-2025-1550, which I discovered at the end of 2024 and for which I was later awarded a bounty by the Google OSS VRP. Exploiting this vulnerability was also the intended solution to the Unintended Behaviour challenge I authored for ToH CTF 2025.

Vulnerability

Don't Trust the Open Link Button in Android Notifications

11 June 2025

Certain characters can cause a mismatch between the link shown in an Android notification and the one opened via the 'Open link' button, potentially tricking users into phishing sites or triggering deep links.

CTF