Pap Gergo

[Victor Fresk0 @hacefresko]

After 6 months of extensive research, I have finally published a new blog post! It describes the journey from breaking into my router using a couple of command injections to finding and exploiting a remote heap overflow in a MediaTek kernel driver :D

https://t.co/FeOrZm0fPa

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[Pap Gergo @PapGergo1]

@bl4sty I don't understand either. 😅

[blasty @bl4sty]

I feel the traditional "responsible disclosure" concept has been broken since its inception. you can argue that forcing everyone's hand by dropping (weaponized) bugs/exploits is reckless/harmful behavior or blablabla but I feel you have to keep in mind everyone's stakes/motivation in the game are different.

one thing I guess we can agree on: people sit on bugs/exploits all the time. sometimes because ZDI promises a big bag of money at the end of the rainbow that magically evaporates and sometimes because they don't want to disclose these things and use them tactfully for their own advantage/goals.

I've always felt forcing this acceleration will (hopefully) get the software landscape in better shape, faster. albeit in a messy way. the noise it creates however could be a good signal for people to get an idea of the overall security posture of a piece of software, as well as get a good idea of how a vendor handles disclosures that don't follow their made up fairytale non-enforceable policies. (that typically don't come with any kind of silver lining)

back then, you could be damn sure that another horde of teenagers grep'd the same src tree for memcpy and was probably also sitting on an exploit. today the same applies, anyone can out-slop you producing the next linux LPE after brad tweets out a commit ID

remember: as a researcher you don't own the vendor anything. you don't own the public anything either. if you did this work for free its yours to publish in whatever way suits your needs, agenda or overall quirkiness. :)

[McCaulay @_mccaulay]

RCEliteLLM - Chaining an Environment Variable Leak with Jinja2 SSTI for Remote Code Execution

https://t.co/ak9bOVRG0N

[ggwhyp @ggwhyp]

I was hoping to compete in Pwn2Own with a Firefox full-chain entry, but unfortunately it was rejected. I’ve reported the vulnerability to the Mozilla team.

[Yuu @anzuukino2802]

This was supposed to be my PoC for a Claude Code RCE aimed at Pwn2Own Berlin 2026, but ZDI never got back to me about my entry registration. It looks like I won't be able to register it at all...

[Calif @calif_io]

MAD Bugs: Finding and Exploiting a 21-Year-Old Vulnerability in PHP

@i0n1c was "the PHP security guy" twenty years ago, so we thought it'd be fun to welcome him with a fresh unserialize UAF.

https://t.co/9ErxpKSELx

[Pap Gergo @PapGergo1]

https://t.co/IRwOS4jJkB

[Victor Fresk0 @hacefresko]

Zyxel has published 2 CVEs for some vulns I found :D

CVE-2025-13943: Authenticated command injection in log export CGI
CVE-2025-13942: Unauthenticated command injection in UPnP daemon

I will blog about this in the coming months. Meanwhile, exploits here: https://t.co/CbVHekdN5q

[0xor0ne @0xor0ne]

Pixel 8 kernel debugging with GDB over serial connection (@andreyknvl)

https://t.co/xcqguFkgat

#cybersecurity

[Dataflow Security @dfsec_com]

Seeing a lot of strong talent impacted by recent tech layoffs.
If you're interested in joining a team scaling thoughtfully and solving hard vulnerability research problems, @dfsec_com is hiring: https://t.co/ZHoJHjAGGY

#hiring #remotefriendly

[PT SWARM @ptswarm]

📞 Microsoft fixed an authenticated RCE in Windows Telephony Service (CVE-2026-20931), discovered by our researcher Sergey Bliznyuk @justbronzebee

Read the write-up: https://t.co/nNsMGF1hLK

[mufinnnnnnn @mufinnnnnnn]

Hacking the same target at p2o 5 years in a row. This is the first time I never acquired or tested on the physical device. 1 bug. No ROP, no hard coded offsets. Screenshot is very satisfying. HUGE thanks to @boredpentester for helping with firmware.

[Pap Gergo @PapGergo1]

Thomson router RCE! 👾🔥

[RET2 Systems @ret2systems]

What does it take to hack a @Sonos Era 300 for Pwn2Own?

Take a look at our process of adapting existing research, establishing a foothold, and exploiting media parsers for unauthenticated RCE over the network🔥👇

https://t.co/FxSbV3uEBp

[watchTowr @watchtowrcyber]

Our client base has been feeding us rumours about in-the-wild exploited SonicWall SMA n-days (CVE-2023-44221, CVE-2024-38475) for a while...

Given these are now CISA KEV, enjoy our now public analysis and reproduction :-)

https://t.co/W3zR5YRifJ

[TheZDIBugs @TheZDIBugs]

[ZDI-25-216|CVE-2024-11131] (Pwn2Own) Synology TC500 ONVIF Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8; Credit: Team Viettel) https://t.co/zyJARz0Fqb

[0xor0ne @0xor0ne]

Emulating WGS-804HPT Industrial Switches firmware for security research

https://t.co/TuNSxK1Tde

Credits @Claroty

#cybersecurity