Pulling Gemini Secrets and Windows HVPT

A long episode this week, featuring an attack that can leak secrets from Gemini's Python sandbox, banks abusing private iOS APIs, and Windows new Hypervisor-enforced Paging Translation (HVPT). Links and vulnerability summaries for this episode are available at: [00:00:00] Introduction [00:00:18] Doing the Due Diligence - Analyzing the Next.js Middleware Bypass [CVE-2025-29927] [00:29:20] We hacked Google’s A.I Gemini and leaked its source code (at least some part) [00:44:40] Improper Use of Private iOS APIs in some Vietnamese Banking Apps [00:55:03] Protecting linear address translations with Hypervisor-enforced Paging Translation (HVPT) [01:06:57] Code reuse in the age of kCET and HVCI [01:13:02] GhidraMCP: LLM Assisted RE [01:31:45] Emulating iOS 14 with qemu Podcast episodes are available on the usual podcast platforms: -- Apple Podcasts: -- Spotify: -- Google Podcasts: -- Other audio platforms can be found at You can also join our discord:

You can listen to Pulling Gemini Secrets and Windows HVPT online on Radio and Podcast. Open the player on this page to stream the available audio.

Pulling Gemini Secrets and Windows HVPT is an episode from Day[0] by dayzerosec.

This episode is 01:33:22 long.

This episode was published on Apr 16, 2025.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from Day[0] when more episodes are available from the podcast feed.