Benasin

Wannabe hacker from 🇻🇳 🐸

[Calif @calif_io]

Early this week, we had a meeting at Apple Park in Cupertino. While there, we also shared with Apple our latest vulnerability research report: the first public macOS kernel memory corruption exploit on M5 silicon, surviving MIE. It was laser printed, in honor of our hacker friends.

Full story: https://t.co/AmKMGUmWPt

[Calif @calif_io]

MAD Bugs: RCE in Ladybird

Blog: https://t.co/I6v4maqsEJ

PoC: https://t.co/g9jmtCZax0

https://t.co/8fB8xLXw8j

[Calif @calif_io]

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.

https://t.co/Cv8M69i1Mk

[Calif @calif_io]

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets.

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.

https://t.co/IxURrHpBT0

[HackerOne @Hacker0x01]

In Singapore, @okx and HackerOne brought an elite team of security researchers together for a live hacking event focused on one thing: building trust through real-time collaboration.

This was security in action—fast-paced, transparent, and deeply human. Researchers tested live systems. Teams worked side by side. Vulnerabilities were uncovered and addressed when it mattered most.

When trust is built in real time, everyone wins.

#H165 #TogetherWeHitHarder

[Benasin @Benasin3]

@LTiDiii @Hacker0x01 @flysec_corp 🔥🔥🔥

[James Kettle @albinowax]

I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame", at #BHUSA! This is going to be epic, check out the abstract for a teaser ↓↓↓

[Benasin @Benasin3]

@dia2diab Congratulations team Egypt 🇪🇬

[Benasin @Benasin3]

@j_zere @Hacker0x01 Congrats man🔥🔥🔥

[slonser @slonser_]

Today I used a technique that’s probably not widely known in the community.
In what cases could code like this lead to a vulnerability? ->

[Benasin @Benasin3]

@janlele91 Congrats anh 💪

[Benasin @Benasin3]

@ElS1carius But anyway, appreciate you checking out my blog post! :D

[Benasin @Benasin3]

@ElS1carius After digging deeper, I found the root cause in lua-nginx-module, which Kong is built on. Still, I believe Kong should have investigated further, as I found the issue easily exploitable across multiple companies using their products!

[Benasin @Benasin3]

@thaivd98 @Hacker0x01 My dream☁️

[Benasin @Benasin3]

@LamScun 🐸🪽

[Benasin @Benasin3]

@LTiDiii @LongShrimp0812 🔥🔥🔥

[Benasin @Benasin3]

@thaivd98 Hungry for more 😋

[Benasin @Benasin3]

@albinowax Also stay tuned for our next blog where we will publish cool findings regarding this bug!

[Benasin @Benasin3]

🚨HTTP Request Smuggling in lua-nginx-module!🚨
This affects major proxies like Kong GW, OpenResty, Apache APISIX and many more👀
Check it out: https://t.co/G9juMax7zk
Big thanks to @albinowax for his awesome research and for answering all my questions!

#bugbounty #bugbountytips