Sebastien Arseneault

cves

CVE-2026-36522
ArduPilot ArduPlane 4.0.1 9.1 critical
NaN injection through the MAVLink PARAM_SET message (CWE-1287). Denial of service where floating-point exceptions are enabled, and silent corruption of flight parameters on production hardware.

Jul 2024 – present
Penetration Tester & Red Team Operator ECS Federal, Remote
Federal healthcare red team. I built and run the Mythic C2 and Apache redirector infrastructure, execute assumed-breach operations mapped to ATT&CK from initial access through objective completion, and do the Active Directory and cloud (AWS, Azure) exploitation that drives the client's remediation priorities. Mentor the junior testers.
Jan 2024 – Jul 2024
Cyber Network Defense Engineer Command Post Technologies, Norfolk, VA
IDS/IPS sensors across federal networks, vulnerability analysis and STIG reporting with ACAS, HBSS, and Juniper SIEM.
May 2023 – Nov 2023
Technical Cybersecurity Assessor, UNIX/Linux AERMOR, Suffolk, VA
STIG and vulnerability assessments on RHEL systems, SCAP automation plus manual checks, authored the assessment reports and briefed findings to system owners.
Apr 2022 – May 2023
Cyber Test Engineer, Red Team Support AERMOR / OPTEVFOR, Norfolk, VA
Cyber test plans for Navy ship systems, including the CVN-78 cyber survivability test plan. OSINT and recon to shape red team objectives, attack vectors for shipboard Linux systems, on-site validation with the operators.

subrecon

Subdomain recon CLI that chains assetfinder, subfinder, dnsx, and httpx into one pipeline. pip and pipx installable.
Deep Woods Security

Independent offensive security research outfit I founded. Supply chain, on-chain infrastructure, and AI systems. We find the routes first and publish what we learn.