Diego Palacios

About

Cybersecurity Engineer
Vulnerability Researcher

I'm Diego Palacios (DiegoAltF4), a security researcher based in Madrid, Spain, focused on low-level vulnerability research and exploit development, with a particular obsession: hypervisors.

By day I work as a Cyber Risk & Security Engineer at WTW; by night, I try to escape virtual machines.

I specialize in finding and exploiting vulnerabilities in complex systems, with a focus on how they interact within real environments to assess their operational impact and prioritize effective mitigation. Away from the debugger, I’ve been playing drums for as long as I can remember. In the jukebox, you’ll find a small selection of tracks I love.

diegoaltf4 [at] protonmail [dot] com

Professional experience

  1. Nov 2024 – present
    WTW · FINEX Western Europe

    Cyber Risk & Security Engineer

    • Conduct technical security assessments and risk analysis, including Azure adversary simulation, initial access testing, and vulnerability research targeting Linux, C/C++ applications and hypervisors.
    • Chain vulnerabilities and misconfigurations into realistic attack scenarios to determine what an attacker can actually achieve.
    • Identify vulnerabilities in client systems and provide the technical analysis behind mitigation decisions.
    • Conduct structured threat modeling for complex systems.
    • Automate internal analysis processes, reducing execution time from hours to minutes.
    • Present technical findings and risk assessments to engineering teams and leadership, including CISOs and CTOs.
  2. Aug 2024 – Sep 2024
    Exodus Intelligence

    Vulnerability Research Intern (N-Day)

    • Conducted N-day vulnerability research focused on hypervisors, analysing recently disclosed vulnerabilities without public exploits or write-ups.
    • Developed proof-of-concept exploits to confirm exploitability and demonstrate impact.
    • Documented vulnerabilities and exploitation details in technical reports.
  3. Jan 2024 – Jul 2024
    Universidad Rey Juan Carlos (URJC)

    Research Fellow at GRAFO (Group for Research in Algorithms For Optimization)

    • Developed heuristic and metaheuristic algorithms for optimization problems in operations research and statistical analysis.
  4. Jun 2023 – Apr 2024
    Confidential

    Security Researcher

    • Role details confidential due to a non-disclosure agreement (NDA).
  5. Nov 2022 – May 2023
    Ericsson R&D

    Security Cloud Trainee

    • Conducted security analysis of cloud-native applications running in Docker containers, developing proof-of-concept exploits to evaluate impact.
    • Developed a ROP chain to call memfd_create, write arbitrary binaries in memory and execute them inside a Docker container built from scratch with a read-only filesystem, enabling tooling execution in a highly constrained environment.
    • Completed the internship with the highest distinction (10/10 with Honors).

Findings (CVEs)

0-days · discovered

CVE-2026-87273VirtualBox: host file read/write, leading to host code execution8.6 (High)
CVE-2026-71131VirtualBox: host file read/write, leading to host code execution8.6 (High)
CVE-2026-71141VirtualBox: arbitrary host file write7.7 (High)
CVE-2026-47047VirtualBox: arbitrary host file write7.8 (High)
CVE-2026-35275VirtualBox: guest-to-host VM escape via Shared Folders7.5 (High)
CVE-2026-35247VirtualBox: guest-to-host info leak enabling an ASLR bypass6.0 (Medium)
CVE-2024-24178–847 vulnerabilities in an IoT device family, enabling unauthenticated remote code execution, denial of service and authentication bypass; discovered with the IoTAK0S team.

N-days · exploited & analysed

CVE-2024-48871PLANET WGS-804HPT industrial switch: unauthenticated stack-based buffer overflow in the web interface, potentially leading to remote code execution. Presented in a WTW industrial cyber-risk webinar.9.8 (Critical)
CVE-2023-22098VirtualBox: VM escape via a virtio-net out-of-bounds write. Public exploit and full write-up.8.2 (High)
CVE-2023-4911Looney Tunables: local privilege escalation in the glibc dynamic loader. Public exploit.7.8 (High)

* The CVE-2023-22098 escape was featured in the Exploits.club newsletter.* Scores based on CVSS v3.1.

Education

MSc Cybersecurity & Privacy

Universitat Oberta de Catalunya, 2024–2025

Final mark9.13/10

BSc Cybersecurity Engineering

Universidad Rey Juan Carlos, 2020–2024

Final mark9.25/10
  • Top graduate across every degree at the School of Computer Engineering (ETSII), with the school's highest GPA.
  • 23 honours distinctions.
  • Bachelor's Degree Extraordinary Award.
  • Thesis on hypervisor exploitation, graded 10/10, co-authored with David Billhardt.

Award notification (signed PDF)Award certificate (PDF)

Competitions

Diego Palacios competing with the Spanish national cybersecurity team
Spanish national team · ECSC 2022
Diego Palacios with teammates at the European Cybersecurity Challenge in Vienna
Competition floor, Vienna · ECSC 2022
  • Winner

    JNIC 2025 CTF

    First place with a URJC team at the CTF of Spain's National Cybersecurity Research Conference.

  • Winner

    Airbus Cyber Day 2024 CTF

    First place with the Zeroclick.sh team at the CTF hosted by Airbus.

  • Winner

    Guardia Civil National CyberLeague 2023

    First place with the Jinchomaniacos team at one of Spain's largest cyber competitions.

  • National team

    European Cybersecurity Challenge 2022

    Represented Spain as a full member of the national team in Vienna.

* A selected list of highlights, not exhaustive.

Talks & workshops

  • 2024

    Mundo Hacker 2024

    A technical session on hypervisor exploitation, from virtualization fundamentals and VirtualBox internals to an N-day VM escape. Presented with David Billhardt.

  • 2024

    HackOn 2024

    A hands-on workshop on practical fuzzing, from setting up a target to finding and analysing crashes. Presented with Daniel Monzón.