SentinelOne Blog

OK, so then you talked to someone at Netflix, and they said, what, "umm... well, we just replaced our anti-virus product with this other thing called SentinelOne that isn't really an anti-virus product", and then you looked at their site and called them and decided they totally weren't an anti-virus product? And that the real story here was that this was the death knell for anti-virus, or the beginning of "post-AV anti-malware", or something?

Clearly you have technical chops. But the most technical part of your article, concerning whatever technology somehow separates this product from the rest of the industry (let alone makes it "not anti-virus"), is this single line:

"Its end-point security doesn’t rely on signatures, it monitors every process on a device to check for irregularities and does not perform on-system scans or require massive updates like anti-virus..."

If SentinelOne is doing something truly new, something that merits coverage from tech journalists, it would be nice to read about it.

And btw, you said earlier, "When I contacted SentinelOne after the interview they said they couldn't even go on the record about the Netflix contract", which is an odd thing for them to have told you, since they have a Netflix logo and an official statement from them under the testimonials section of http://www.sentinelone.com/?show_epp=true -- wait a minute, in fact the quote from your article is a word-for-word match for the testimonial on SentinelOne's site: "The direction…

SentinelOne | Backend Developers | Remote (US) | Full-Time | https://sentinelone.com

After the successful launch of the new Singularity Marketplace, I am looking for an engineer to join our small Apps engineering team in the United States. We want somebody that has been in the trenches working with medium/big systems, loves functional programming (even if is afraid to say that loudly) and has a solid API background.

You’ll be working with a variety of partners and their APIs to supercharge SentinelOne’s threat analysis and detonation. Sometimes we’ll be dealing with nice OpenAPI files, semantic status codes and structured error responses; sometimes the documentation is an email, every API call returns 200 (even if an entire server farm has just crashed) and payloads are so nested that you’ll need a GPS to figure out where you are. Are you up for the challenge?

If you:

* Have experience with functional programming languages (Clojure, Haskell) or strong desire to learn

* Have experience with Node and TypeScript or strong desire to learn

* Have experience in designing and implementing (real) RESTful APIs

* Have used and survived other people’s API

…and you’re interested in

* Designing and implementing public APIs for external users

* Build and maintain user SDKs in different languages

Then please email me at vncz at SentinelOne.com and let's chat.

From the linked source code [0], the vulnerabilities are:

CVE-2026-10702 [1]: A crafted JavaScript payload can trigger JIT miscompilation in Firefox versions prior to 151.0.3, leading to type confusion and potential renderer crashes or memory corruption.

CVE-2026-43499 [2]: When the kernel's real-time mutex (rtmutex) component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' (UAF) vulnerability, where the system attempts to use memory that has already been released. A local attacker could potentially exploit this to gain elevated privileges or execute unauthorized code.

0: https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack

1: https://www.sentinelone.com/vulnerability-database/cve-2026-10702/

2: https://access.redhat.com/security/cve/cve-2026-43499

Here's a demonstration of some example attacks using pdf: executing arbitrary js, and connecting to a samba server: https://www.sentinelone.com/blog/malicious-pdfs-revealing-techniques-behind-attacks/

I'm not sure about this attack specifically, though, and in Ronin's post mortem they aren't really talking about that: https://roninblockchain.substack.com/p/back-to-building-ronin-security-breach.

To some extent, the PDF viewer/OS doesn't matter. A dedicated and well resourced attacker like the Lazarus Group will find holes in all of them. The "right" move here would have been for the employee not to download the compromised pdf, and short of that, for the IT Security team at Ronin to quickly detect the weird traffic that resulted and isolate the validators to prevent a compromise of their critical assets.

FileZilla author was caught red handed, shipping app with IronCore adware downloader, aka installCore from ironSource:

https://www.sentinelone.com/blog/osx-ironcore-a-or-what-we-know-about-osx-flashimitator-a/

As IronCore evolved, it eventually got packed — `+[obj load]` executed prior to entry point — and provided a JavaScript to Objective-C bridge. JS payloads were remotely downloaded and AES encrypted...

While offers were the usual suspects back then (Advanced Mac Cleaner, MacKeeper, and a customized Chromium app), the technique could be abused in a couple of ways so to spy on specific targets.

Anyhow, I don't know what you do with FZ, I am very much into rsync (OSS) and Transmit app (Panic).

> Little Snitch is a malware vector, pretty much like PC "antivirus" software.

Is that because the Little Snitch network capture parser can be exploited by magic/malformed network packets to gain kernel privileges? Are there known exploits that were previously patched?

Do you recommend any alternative Mac firewall which doesn't have this problem? Can the native firewall perform outbound packet filtering?

Edit: https://www.sentinelone.com/blog/shut-snitch-reverse-engineering-exploiting-critical-little-snitch-vulnerability-reverse-engineering-mac-os-x/ (2016)