Bug Hunting in Hypervisors by Corentin Bayet (@OnlyTheDuck) and @BrunoPujos
๐ Oct 12-15
๐ Espace Vinci or Espace Clรฉry, Paris 2nd
๐ https://t.co/bABXcLpDn5
Weโre proud to bring our" Bug Hunting in Hypervisors" training to @hexacon_fr (October 12thโ15th, 2026) !
Designed for security researchers,we will dive into VM escapes, hypervisor attack surfaces, and real-world exploitation.
See you there !
Awesome bp on a Workstation escape using a bug I also found in 2024, and never managed to exploit... Found the ESXi vuln I used at the same #Pwn2Own while looking for interesting objects to overwrite with the LFH OOB ๐
Those guys found the bug and exploited it in a few days !
At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller.
Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit.
๐ Full technical write-up ๐
https://t.co/R0E5Uqql1E
Our training "Bug Hunting in Hypervisors" ย returns at @reconmtl in 2026!
Taught by researchers actively working on real-world hypervisor exploitation #Pwn2Own
Designed for security researchers, we will dive into VM escapes, hypervisor attack surfaces, and real-world exploitation
๐จ REcon 2026 is LIVE!
๐ Call for papers and registration are now open!
Join the world's top reverse engineers & exploit devs in Montreal:
๐ Trainings: June 15-18 (19 hands-on classes โ AI agents, kernel exploits, Rust/Go reversing, fault injection & more!)
๐ Conference: June 19-21
Tickets & early bird now open โ https://t.co/ESqkwzJOZR
Shoutout to the legends teaching: @SinSinology@KyleMartin@MalachiJonesPhD@andreyknvl@mr_phrazer@yarden_shafir@DrCh40s@pulsoid
+ more elite instructors! See website for all trainers and session info.
Limited spots โ see you in MTL! #REcon2026 #ReverseEngineering
Our latest post details how we exploited Retbleed (a CPU vulnerability) to compromise a machine from a sandboxed process and VM!
Curious? ๐
https://t.co/CSD8kdlBjD
Love the top-bottom approach of this blogpost ! A great way to explain internals in my opinion, and the kind of reference you look when you're trying to exploit a heap bug. Also glad to see that our paper (with @paulfariello) of 2020 is still relevant !
Good morning! Just published a blog post diving into Windows Kernel Pool internals: basics, memory allocation functions, internal structures, and how Segment Heap, LFH, and VS work.
https://t.co/2KlYba9gxc
@typhooncon is already over, but we enjoyed every minute ! During our talk "Journey To Freedom", we disclosed for the first time the details on the Windows LPE we used at Pwn2Own Vancouver 2024 after escaping from VirtualBox. Slides are already available: https://t.co/Zybc7CTZhr
And that's a wrap for @offensive_con and #Pwn2Own ! We had the best time there and were so glad to reunite with the finest researchers out there. See you next year !