Quentin M

Security Ninja @synacktiv

[Quentin M @0xdagger]

So proud to talk for the first time at @offensive_con about how fun it is to escape the Safari sandbox!

[offensivecon @offensive_con]

Escaping the Safari Sandbox: A Tour of Webkit IPC by @0xdagger
https://t.co/1LnSKfkdLI

[Calif @calif_io]

CVE-2026-86950: The Great Glyph Grift

https://t.co/b6VaPER5kT

[_ZN4DionC1Ev @justdionysus]

Our BH slides are up at: https://t.co/162aGs2kwY we’ll release a more detailed description of our macOS LPE later but this gives the gist even without the commentary. Thanks to all who came to the talk!

[[email protected] @opa334dev]

Dopamine 3 is out

https://t.co/rZoBewCtNv

[TheRealClarity @imnotclarity]

As promised, DarkSword Kernel Exploit writeup is now live at https://t.co/aji0Xc3JNU
This goes over the root cause, what happens on the Kernel side and how the kernel exploit is implemented.
Hope it helps anyone looking to understand it! :)

[Calif @calif_io]

Apple MIE exploitation challenge:
https://t.co/WlnrCkW6Gw

Two months ago, we demonstrated the first public bypass of Apple MIE on macOS 26.4.1. We withheld the technical details until Apple shipped fixes, which are now available in macOS 26.6. We'd like to thank Apple for their collaboration throughout this disclosure process. Since March, we've reported 38 vulnerabilities to Apple and counting.

In this blog, we'll share the details of the two vulnerabilities behind our exploit. We'll present the full exploit at Black Hat USA on August 5 and publish the complete technical report afterward.

Before then, we'd like to turn these bugs into a challenge. Apple MIE combines defenses across hardware, the hypervisor, the kernel, and userspace. Together, they form a mesh of overlapping filters that block many classes of vulnerabilities. Apple also continues to strengthen these mitigations over time.

Given their complexity, rapid evolution, and the limited public discussion of exploitation techniques, we believe modern XNU kernel exploitation is one of the hardest and most interesting benchmarks for AI-assisted exploit development. We'd love to see how the community solves this challenge before we reveal our own approach at Black Hat. Humans, AI, and human-AI teams are all welcome.

We're looking forward to seeing different solutions and learning new techniques. It took us about five days to go from bug discovery to a polished exploit for this chain.

[Calif @calif_io]

Journey to Root, Episode I: The Maglev King

Welcome to the first installment of our series on AI-assisted browser bug hunting and exploit development. We will walk you through a Google Chrome exploit chain, from the V8 JavaScript engine in the renderer to the GPU process. We demonstrate the full chain on Windows, and for the GPU compromise we also show a novel technique on Linux, where the mitigations are tougher to defeat.

Demo (with BEATS!): https://t.co/Jx8aAp1sMi

Full write-up: https://t.co/s0XRxLIGDL

[littlelailo @littlelailo]

Had a lot of fun reversing Coruna over the last couple weeks and decided it would be worth to write it all up before I forget - so enjoy :)

https://t.co/DWld4SWgf6

[Hexacon @hexacon_fr]

The training lineup for Hexacon 2026 is now available on our website 🧑🏼‍🏫

Training tickets sales will officially launch in mid-May 🎫

https://t.co/fFLYxCKV76

[Seth Jenkins @__sethJenkins]

We really should be talking about this more....KASLR is just not working properly on Android right now, and it hasn't for a long time.

https://t.co/AE0vBXEcob

[Synacktiv @Synacktiv]

A look back at our ninjas' first day at @Hexacon!

We are proud of our experts Quentin and Etienne, who are leading the ‘iOS for Security Engineers’ training course.
At the same time, Matthieu and Paul are hard at work on the ‘Azure intrusion for red teamers’ training course!

Happy training 🎓

[binaryboy @b1n4r1b01]

Writeup for CVE-2025-24085, an ITW mediaplaybackd vulnerability patched earlier this year https://t.co/XopOVNmfnc

[Quentin M @0xdagger]

MTE in libPas 👀 https://t.co/A6spV0Q9VD

[Quentin M @0xdagger]

@xvonfers "https://t.co/HMJfclLn0j.script-restrictions" 👀

[Tim Willis @itswillis]

That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes)

https://t.co/Atc6toEdAj

[Exodus Intelligence @XI_Research]

We dissect a DFG compiler bug we discovered in Safari/WebKit. This post covers root cause, impact, and technical analysis:

https://t.co/Q4IOsQ9dP8

#WebKit #VulnerabilityResearch #ExploitDev #Safari #CyberSecurity #ExodusIntel

[Eloi Benoist-Vanderbeken @elvanderb]

Not their best picture but definitely THE best hands-on iOS training!
Come and see for yourself how Etienne and Quentin master iOS!
⚠️ Warning, risk of massive skills overflow ⚠️

[Synacktiv @Synacktiv]

🚨 Still a few seats left for our iOS for Security Engineers training at #HEXACON2025!
4‑day hands-on labs to explore the iOS ecosystem and prepare for vulnerability research.
📍 Paris, Oct 6‑9 ➡️ https://t.co/MABakGZV6o

[Quentin M @0xdagger]

@iamAlexGalvan We currently offer in-person training only. No online trainings available at the moment.

[Quentin M @0xdagger]

It's never too late to start vulnerability research on iOS! Our training has been made by experienced iOS security researchers for newcomers in the iOS area who want to start developing "extremely sophisticated attacks"! :-) https://t.co/sqds4ThJ8l

[Synacktiv @Synacktiv]

There are still seats available for our "iOS for Security Engineers" training at #HEXACON2025! Book it while it's hot 😉
Conference tickets are also still available if you register for a training.

[Quentin M @0xdagger]

@cvewhen Our training is focused on the iOS system in itself rather than exploit development. You can expect fully updated content related to the system and its security. If iOS 26 brings new security features we will do our best to cover them at Hexacon.

[Quentin M @0xdagger]

@indigo79x One requirement for our training is to have basic knowledge in programming (especially in C language). So I think it is advisable for you to sign up if you want to start research on iOS 🙂