Shadow Chaser Group

Shadow Chaser Group is a sub-group of the GcowSec team which consists of college students who love it.Shadow Chaser Group focused on APT hunt and analysis

[Shadow Chaser Group @ShadowChasing1]

Hi,bro
Shadow Chaser Group is a sub-group of the GcowSec team which consists of college students who love it.Shadow Chaser Group is focus on #APT hunte and analysis
I hope you will follow us :-)

[Ziyi Guo @tripleh_life]

"Bad UVM" - Privilege Escalation, Container Escape via NVIDIA GPU UVM - hijack read-only page cache.

More details: https://t.co/WUQpTH5HH1

[NebuSec @nebusecurity]

Proxmox VE 7.x authentication bypass (pre-auth RCE)

[NebuSec @nebusecurity]

Fixing carbon buildup in a turbocharged engine might cost you $55,000. Here is how we exploited a flaw we found in Google V8's Turboshaft.

We received reports that this vulnerability was exploited against some products. Make sure your Chromium is up to date. Writeup below.

[NebuSec @nebusecurity]

25 elite hacking teams raced in the final kernelCTF. NebuSec closed out the history of the classic kernelCTF with 99% exploit stability, 0.1s exploit time, and 0.000461s submission time.

We’ll soon open-source our kernelCTF infra and a walkthrough of how we won every kCTF we entered, and pushed our time cost down to the absolute minimum.

[NebuSec @nebusecurity]

CVE-2023-2156 was believed to be just a remote kernel DoS, patched in 2023.

We found a bypass and achieve privilege escalation and container escape.

Read the $10,500 story of CVE-2026-43501 "Route of Root":
https://t.co/SnveNORatM

[NebuSec @nebusecurity]

Amazing work.

[NebuSec @nebusecurity]

We’ve open-sourced one-click Docker setups and full exploits for Nginx-{PoolSlip, QuicBurst}, both with remote ASLR bypasses.

Try them here:
https://t.co/qx0TiXc9jk

PoolSlip's OOB write leaks ASLR data extremely fast, while QuicBurst's UAF takes longer.

[NebuSec @nebusecurity]

Here's the final chapter of our IonStack series, the Android rooting part.

Including how we use GhostLock (CVE-2026-43499) to defeated KASLR on Android and bypassed KCFI to get arbitrary kernel memory read and write:
https://t.co/p14D2qAdft

[NebuSec @nebusecurity]

We can easily find more vulnerabilities, the reason we didn't do that is simply we don't have enough people to patch them all.

During our first scan in Feb, we found 600+ vulnerabilities in Linux kernel and till nowadays 100+ patches were merged and we are still fixing the rest of them...

[NebuSec @nebusecurity]

After the Hugging Face incident, have you wondered how easy it is to escape a modern agent sandbox?

We benchmarked eight open-source agent sandboxes to show how vulnerable they can be, and why frontier models can break out so easily. https://t.co/gkwdNz0wKT

[crazyman @crazyman823886]

Do you enjoy vibe-coding piles of open-source software that nobody uses? Shipping self-indulgent products and wondering why nobody else seems impressed? Want to know what someone outside your own head might think of your product? https://t.co/ZTrR6jOiMF

[NebuSec @nebusecurity]

Watch us open the camera and uncover the anonymous identity behind Tor browser:

We published the writeup for the browser RCE in IonStack. Mythos reported 271 bugs in Firefox 150 but still missed this one. And the Tor Browser is also affected by CVE-2026-10702.

Update your Tor!

[NebuSec @nebusecurity]

We won kernelCTF again with a new 0-day vulnerability and eligible for another $100k bounty

[NebuSec @nebusecurity]

Try a live IonStack root on your Pixel 10: https://t.co/EkOrNlQ5ew

In the IonStack demo, we left the rootme URL visible and put up a giant countdown as a tribute to jailbreakme.

[NebuSec @nebusecurity]

GhostLock (CVE-2026-43499) is a 15yr old kernel 0-day we used in IonStack full chain exploit.

Everything around you, as long as it runs Linux, from IoT to mobile to desktop, is affected.

Read how we won $92,337 bug bounty with GhostLock and see our exploit on Github. Link below

[Qyn @qynln]

For this (maybe last) year of SekaiCTF I made a fullchain challenge, chaining together an 0-day in ladybird/libjs, an 0-day qemu TCG LPE and a n-day qemu escape:

https://t.co/w8KbB5EUMg

We also re-released another challenge with a running bounty until next week!

[r3kapig @r3kapig]

R3CTF 2026 has come to a successful close. Please join us in congratulating this year’s award-winning teams!

🥇 BBBB
🥈 EQST
🥉 @ProjectSEKAIctf

Thank you to our sponsors @nebusecurity @osec_io @zellic_io @vector35 @googlecloud

Hope see you next year!

[r3kapig @r3kapig]

R3CTF 2026 will begin in less than 24 hours. We hope you have already registered the necessary accounts and created your team here -> https://t.co/0T8lkA8PaO

We would like to express our sincere gratitude to our sponsors, whose support has made this year’s event possible.

[NebuSec @nebusecurity]

Since V8 had heap sandbox, Chrome renderer RCE usually means chaining 2 bugs

Today we bring the Spear of Longinus
1 bug, 100% success, no heap spray, found in 40+ major versions, arbitrary renderer read/write + V8 sandbox escape

Our CVE-2026-6307 writeup https://t.co/zPnCJ4y0R3

[NebuSec @nebusecurity]

"IonStack" is chained with two 0-days: CVE-2026-10702 and CVE-2026-43499.

CVE-2026-10702 is a Firefox 0-day. At its core, it was an instruction-modeling flaw buried deep inside IonMonkey, Firefox’s highly complex JIT compiler. Even after Mythos’s extensive audits, the bug was still missed. This is the first publicly disclosed JIT vulnerability since then.

We were able to uncover the vulnerability and turn it into a highly stable exploit with a nearly 100% success rate, ultimately achieving remote arbitrary code execution in Firefox.

CVE-2026-43499 is a universal Linux kernel LPE vulnerability that has lived in the kernel tree for 15 years since v2.6.38 and affects every distribution: desktop, server, Android, and embedded. It does not require any special kernel modules; CONFIG_FUTEX_PI is all it needs, and to our knowledge, it’s enabled across all distributions we researched.

The bug primitive is a UAF in stack caused by a race condition. Turning it into a reliable LPE takes several stack tricks, but eventually it becomes very stable. We measured 10/10 successful privilege escalations on Linux 6.12, along with a high success rate on Android.

We will write a series of blog posts disclosing both 0-days used in “IonStack”. The first post is coming soon. Stay tuned.