mk0 @fancymalware

oof ... After consecutive days, Done proper UI Designs and major architecture change for network Malleability + along with stealthy bofs.... Just taking some break today =)

Smukx.E @5mukx

3 days ago

I just wasted 7 hours debugging for one BOF. I found a lot of bugs along the way, fixed them, but still couldn't achieve what i was targeted for. I was just scrolling on Pinterest when I found this quote. Again, I sat back to finish this stuff, lol ! Let's see how this goes...

3 7 129 8K 19

Funny leak at Chrome No AI, Just @J0R1AN and a brilliant idea And yeah, this is only a small part of something bigger -writeup coming soon😵

Pleased to publish a browser-related research paper (w/@inzo____) titled: One trigram at a time: XSLeak via Universal CSS Injection and DoS in Opera (GX) The title speaks for itself. Enjoy the read! zhero-web-sec.github.io/research-and-t…

This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀 github.com/WICG/declarati…

For this (maybe last) year of SekaiCTF I made a fullchain challenge, chaining together an 0-day in ladybird/libjs, an 0-day qemu TCG LPE and a n-day qemu escape: qyn.app/blog/sekaictf-… We also re-released another challenge with a running bounty until next week!

Since V8 had heap sandbox, Chrome renderer RCE usually means chaining 2 bugs Today we bring the Spear of Longinus 1 bug, 100% success, no heap spray, found in 40+ major versions, arbitrary renderer read/write + V8 sandbox escape Our CVE-2026-6307 writeup nebusec.ai/research/v8-cv…

@RtlDallas yep, happening to a lot of researchers - x.com/5mukx/status/2…

Smukx.E @5mukx

a week ago

@HackingDave @0xBoku Someone is specifically reporting every offensive post. For example, after i got my acc back, I woke up this morning to find that many of my posts had been locked.

6 7 80 4K 9

Paper currently being written. Expected to be the next publication, God willing. As no companies have yet been found whose vision and values truly align with ours, sponsorships, partnerships, and selective intellectual property transfers related to ongoing and future research remain open for discussion.

zhero; @zhero___

5 months ago

can merely visiting a website lead to cross-site data exfiltration from any site without user interaction? a ""minimal"" PoC has been validated, successfully exfiltrating, as a demonstration, the victim’s gmail address report submitted, hoping to provide more details soon

4 4 211 46K 48

"IonStack" is chained with two 0-days: CVE-2026-10702 and CVE-2026-43499. CVE-2026-10702 is a Firefox 0-day. At its core, it was an instruction-modeling flaw buried deep inside IonMonkey, Firefox’s highly complex JIT compiler. Even after Mythos’s extensive audits, the bug was still missed. This is the first publicly disclosed JIT vulnerability since then. We were able to uncover the vulnerability and turn it into a highly stable exploit with a nearly 100% success rate, ultimately achieving remote arbitrary code execution in Firefox. CVE-2026-43499 is a universal Linux kernel LPE vulnerability that has lived in the kernel tree for 15 years since v2.6.38 and affects every distribution: desktop, server, Android, and embedded. It does not require any special kernel modules; CONFIG_FUTEX_PI is all it needs, and to our knowledge, it’s enabled across all distributions we researched. The bug primitive is a UAF in stack caused by a race condition. Turning it into a reliable LPE takes several stack tricks, but eventually it becomes very stable. We measured 10/10 successful privilege escalations on Linux 6.12, along with a high success rate on Android. We will write a series of blog posts disclosing both 0-days used in “IonStack”. The first post is coming soon. Stay tuned.

I co-authored an educational article on cache poisoning vulnerabilities with @intigriti. If you're looking to understand the fundamentals and pick up a few practical tips along the way, give it a read!

Intigriti @intigriti

2 weeks ago

Most hunters skip web cache poisoning because it looks intimidating... 😓 But a single misconfigured cache layer can regularly turn into critical findings, even on heavily tested targets! 🤠 In our latest article, we walk you through identifying cache layers, spotting unkeyed

3 63 341 51K 334

@nebusecurity are y'all planning to release a writeup of the full-chain?

@spiceoverflow @_N0xi0us_ @intigriti i didn't say it was unreasonable - the issue to me is giving a deadline while it takes them months to triage a report (and probably not giving any updates during triage)

Nebula Security is now backed by Y Combinator. We’re celebrating by bringing you the world’s first Android 17 root demo — “IonStack”, a url click can let attacker fully control your phone. This is not only an Android root demo. We’re bringing you a full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 and all Linux distros in 15 years. "IonStack" demonstrates how bad actors can control your phone by sending a malicious URL, but good news, Nebula Security found it before attackers do. Both 0-day were found by our code scanning agent, VEGA, overshadowing any vulnerabilities found by Mythos or any scanner you name it. VEGA has demonstrated its extraordinary capability in finding critical bugs in the world’s most complicated software: operating systems and browsers. It can spot the same vulnerabilities in your codebase too. VEGA support full scan and incremental scan that can integrated into your CI/CD flow. We launched VEGA within YC companies and received overwhelmingly positive feedback. Now it is open to all enterprise customers in private beta. Book a demo with us: nebusec.ai/book-a-demo

@_N0xi0us_ @intigriti i meant in giving u limited time to reply after it took them 3 months to even triage the report :)

@seriotonctf @_ZeroPointSec gg !

All my projects are back to custom VPS. Its been so hard to setup my own custom gitea where i have worked on custom features... More updates are on the way... Git: git.smukx.site

Happy Friday... again. Yes, we've been left unattended, allowing us to run amok and publish our analysis of CVE-2026-20253 - an Arbitrary File Write in Splunk Enterprise that can be turned into Pre-Auth RCE... Enjoy, friends! labs.watchtowr.com/why-use-app-le…

We published a new research article on the Chromium 146 Renderer Process! In this article, we start from the CVE-2026-3910 Maglev write barrier elision bug and walk through the full exploit chain: building a V8 heap R/W primitive via a GC-induced UAF, achieving an out-of-sandbox read using WebAssembly internals, abusing JSPI UAF and StackMemory / JumpBuffer, and ultimately reaching renderer process RCE. Our goal was to provide a structured explanation of how modern V8 exploitation works in practice, from compiler-level bug analysis to sandbox-boundary primitives and final code execution. Huge thanks to our team member @m411k_ for conducting this research! Check out the PoC! Full article: research.rewritelab.org/2026/06/11/%5B…

@es3n1n nah I hope it will :3

@es3n1n all my life savings on red!