cbayet

Security expert and CTO @Reverse_Tactics

[Hexacon @hexacon_fr]

Bug Hunting in Hypervisors by Corentin Bayet (@OnlyTheDuck) and @BrunoPujos

📅 Oct 12-15
📍 Espace Vinci or Espace Cléry, Paris 2nd
👉 https://t.co/bABXcLpDn5

[Hexacon @hexacon_fr]

It's live!

➡️ https://t.co/vZUo5mOvyw

[cbayet @OnlyTheDuck]

Really proud to be a trainer at @hexacon_fr !

[REverse_Tactics @Reverse_Tactics]

We’re proud to bring our" Bug Hunting in Hypervisors" training to @hexacon_fr (October 12th–15th, 2026) !

Designed for security researchers,we will dive into VM escapes, hypervisor attack surfaces, and real-world exploitation.

See you there !

[TheZDIBugs @TheZDIBugs]

[ZDI-26-188|CVE-2025-41237] (Pwn2Own) VMware ESXi VMCI Integer Underflow Local Privilege Escalation Vulnerability (CVSS 8.2; Credit: Corentin "@OnlyTheDuck" BAYET from REverse Tactics) https://t.co/p37AZfHL6Z

[cbayet @OnlyTheDuck]

This bug is found and triggered by students of our training 😉
https://t.co/eNKGZihTEK

[cbayet @OnlyTheDuck]

Awesome bp on a Workstation escape using a bug I also found in 2024, and never managed to exploit... Found the ESXi vuln I used at the same #Pwn2Own while looking for interesting objects to overwrite with the LFH OOB 😅
Those guys found the bug and exploited it in a few days !

[Synacktiv @Synacktiv]

At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller.
Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit.

🔍 Full technical write-up 👇
https://t.co/R0E5Uqql1E

[cbayet @OnlyTheDuck]

Will be at @reconmtl again this year 🥰

[REverse_Tactics @Reverse_Tactics]

Our training "Bug Hunting in Hypervisors"  returns at @reconmtl in 2026!
Taught by researchers actively working on real-world hypervisor exploitation #Pwn2Own
Designed for security researchers, we will dive into VM escapes, hypervisor attack surfaces, and real-world exploitation

[REcon @reconmtl]

🚨 REcon 2026 is LIVE!
🚀 Call for papers and registration are now open!

Join the world's top reverse engineers & exploit devs in Montreal:

🛠 Trainings: June 15-18 (19 hands-on classes – AI agents, kernel exploits, Rust/Go reversing, fault injection & more!)

📅 Conference: June 19-21
Tickets & early bird now open → https://t.co/ESqkwzJOZR

Shoutout to the legends teaching: @SinSinology @KyleMartin @MalachiJonesPhD @andreyknvl @mr_phrazer @yarden_shafir @DrCh40s @pulsoid
+ more elite instructors! See website for all trainers and session info.

Limited spots – see you in MTL! #REcon2026 #ReverseEngineering

[cbayet @OnlyTheDuck]

@carrot_c4k3 Legend 😂

[cbayet @OnlyTheDuck]

@SinSinology @thezdi @TrendMicro GG !!

[cbayet @OnlyTheDuck]

@theflow0 Impressive exploit and the blog post is so easy to read ! Amazing work 👌

[Google VRP (Google Bug Hunters) @GoogleVRP]

Our latest post details how we exploited Retbleed (a CPU vulnerability) to compromise a machine from a sandboxed process and VM!

Curious? 👇

https://t.co/CSD8kdlBjD

[cbayet @OnlyTheDuck]

Love the top-bottom approach of this blogpost ! A great way to explain internals in my opinion, and the kind of reference you look when you're trying to exploit a heap bug. Also glad to see that our paper (with @paulfariello) of 2020 is still relevant !

[ö @r0keb]

Good morning! Just published a blog post diving into Windows Kernel Pool internals: basics, memory allocation functions, internal structures, and how Segment Heap, LFH, and VS work.
https://t.co/2KlYba9gxc

[cbayet @OnlyTheDuck]

@roddux Haha forever basically meant as long as I can remember 😅 but yeah there is some commits at least 17 years old there 😉

[cbayet @OnlyTheDuck]

Jet lag hit hard but still really enjoyed @typhooncon, Seoul and meeting new friends 😁

[REverse_Tactics @Reverse_Tactics]

@typhooncon is already over, but we enjoyed every minute ! During our talk "Journey To Freedom", we disclosed for the first time the details on the Windows LPE we used at Pwn2Own Vancouver 2024 after escaping from VirtualBox. Slides are already available: https://t.co/Zybc7CTZhr

[TyphoonCon🌪️ @typhooncon]

🌪️ Back from lunch just in time to escape VirtualBox and unchaining objects in the Windows Kernel with Corentin Bayet

[REverse_Tactics @Reverse_Tactics]

Slides and video of our talk at @offensive_con are already online !
Thanks to @Binary_Gecko for the amazing event
https://t.co/jM4yotvZxg

[cbayet @OnlyTheDuck]

@offensive_con Let me know if you'll be at @typhooncon !

[cbayet @OnlyTheDuck]

Had a blast at @offensive_con and #Pwn2Own ! Going to sleep now, but not for long...

[REverse_Tactics @Reverse_Tactics]

And that's a wrap for @offensive_con and #Pwn2Own ! We had the best time there and were so glad to reunite with the finest researchers out there. See you next year !