clem1

tail -f internet | grep exploit

[Boris Larin @oct0xor]

We analyzed the Coruna exploit kit and found intriguing code overlaps with Operation Triangulation. Full analysis on our blog: link below.

[clem1 @_clem1]

@Now_on_VT @virustotal https://t.co/dGKGh7RWNh 🎁

[John Scott-Railton @jsrailton]

BREAKING: powerful iPhone hacking tools used by Chinese criminals originated from US defense giant L3 Harris.

The $LHX zero-click exploits went to Russian spies too.

Unbelievable harm to our collective security.

Scoop by @lorenzofb, here's why this matters 1/

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

A full iOS exploit toolkit, "Coruna," has been found in the wild, hacking iPhones that visited infected websites, used by Russian spies targeting Ukrainians and thieves targeting Chinese crypto holders. And it may have been created for the US government. https://t.co/59rIUoevNS

[Mandiant (part of Google Cloud) @Mandiant]

Coruna exploit kit is targeting iOS.

Coruna leverages 23 exploits against Apple devices running iOS 13-17.2.1. It is being used for espionage, and by financially motivated actors to steal crypto.

Update your iOS devices, and learn more about this threat: https://t.co/c7QRDPWMKI

[Ivan Fratric 💙💛 @ifsecure]

New Project Zero blogpost series describing a 0-click exploit chain targeting Pixel 9, featuring a Dolby decoder bug spotted by yours truly.

[Vas Panagiotopoulos @criticalvas]

⚠️ @RSF_inter has uncovered a previously unknown #spyware tool used by the State Security Committee (KGB) of 🇧🇾Belarus to target, among others, journalists and media workers.

https://t.co/Khpio9TA2C

[Natalie Silvanovich @natashenka]

We launched a redesigned Project Zero website today at https://t.co/Prd8nehY7q !

To mark the occasion, we released some older posts that never quite made it out of drafts.

Enjoy!

[Project Zero Bugs @ProjectZeroBugs]

Adobe DNG SDK: areaSpec overlap miscalculation lead to integer overflow, leading to OOB read/write https://t.co/C8cbQ8oui9

[blackorbird @blackorbird]

This issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.

CVE-2025-43529 is a WebKit use-after-free remote code execution flaw that can be exploited by processing maliciously crafted web content. Apple says the flaw was discovered by Google’s Threat Analysis Group.

CVE-2025-14174 is a WebKit memory corruption flaw that could lead to memory corruption.

https://t.co/Z7440s1RhP

[N/A][466192044] High CVE-2025-14174: Out of bounds memory access in ANGLE. Reported by Apple Security Engineering and Architecture (SEAR) and Google Threat Analysis Group on 2025-12-05
https://t.co/0SBYW75Bhn

ANGLE and WebGL 2.0 in WebKit
https://t.co/E5AtdHBHvV

[Natalie Silvanovich @natashenka]

An analysis of a recent 0-click exploit targeting Samsung devices:

https://t.co/ChQTJY16QJ

[Donncha Ó Cearbhaill @DonnchaC]

🚨 A huge leak exposes the new targets and internal operations of Intellexa, the secretive and murky company behind the notorious Predator spyware.

Introducing #IntellexaLeaks, a joint investigation with partners @insidestory_gr, @haaretzcom & WAV Research Collective 🧵👇

[Samuel Groß @5aelo]

We derestricted a number of vulnerabilities found by Big Sleep in JavaScriptCore today: https://t.co/mKSWXXWmXG

All of them were fixed in the iOS 26.1 (and equivalent) update last month. Definitely some cool bugs in there!

[Seth Jenkins @__sethJenkins]

All my recent activity wasn't for nothing...I'm pleased to announce that I'll be speaking at @DistrictCon with @natashenka about a 0-click to kernel exploit chain for the Pixel 9 in January!

[clem1 @_clem1]

@billmarczak https://t.co/h7fLDqs7B0 🧨

[Project Zero Bugs @ProjectZeroBugs]

Samsung: QuramDng getOverlap miscalculation leads to integer overflow, leading to out-of-bounds read/write https://t.co/ymROHlf8bE

[xvonfers @xvonfers]

woah...Exploited ITW
(CVE-2025-10585)[445380761][compiler][maglev]Type Confusion
https://t.co/hDTfgo0aPt
https://t.co/g51IHemMKc
https://t.co/iphJnonX6e

Reported by Google TAG

[Hexacon @hexacon_fr]

We’re thrilled to announce Donncha Ó Cearbhaill (@DonnchaC) as our keynote speaker for HEXACON 2025! 💥

No doubt he has plenty of juicy stories up his sleeve 👾

[Ivan Fratric 💙💛 @ifsecure]

If you've been keeping track on the Big Sleep bug tracker at https://t.co/TeYPpUANyW you might have noticed it lists more bugs now compared to last week. Including a "High impact issue in V8" :)

[xvonfers @xvonfers]

Exploited ITW
(CVE-2025-6558)[427162086]Incorrect validation of untrusted input(transform feedback buffer modification)
https://t.co/K7R3nSiQj9
https://t.co/DmvKa9nErk

Reported by Clément Lecigne(@_clem1) and Vlad Stolyarov(@vladhiewsha)