Amit Sahu

Hacking Android | Kernel Vuln Research | Exp Dev | CTFs with @Water_Paddler

[Amit Sahu @ameetsaahu]

@andersonc0d3 @dfranke @Zai_org @Kimi_Moonshot I think the crash is caused by "the unexpected value leading to a later access of unmapped memory" i.e. `empty_zero_page`.
I am confused as well about the "Why would the musl code munmap a range that is still in use?" part.

[TheRealClarity @imnotclarity]

As promised, DarkSword Kernel Exploit writeup is now live at https://t.co/aji0Xc3JNU
This goes over the root cause, what happens on the Kernel side and how the kernel exploit is implemented.
Hope it helps anyone looking to understand it! :)

[Project Zero Bugs @ProjectZeroBugs]

LWIS kernel driver OOB write in lwis_io_buffer_write https://t.co/H1C0rTwuT1

[qwerty @_qwerty_po]

Introducing the Frag Gap
(CVE-2026-53362/CVE-2026-53366)!

A bug in ipv4/ipv6 that I found together with @physicube, and it (used to) let you freely get root.

This could affect Android too, but we don't have a device so...

Full details are written up in both EN and KO at https://t.co/sQZhd5gioD

If you're curious about the code, just checking out https://t.co/n70dTMdH3s is enough.

We've got a few more fun bugs, and we'll post them as we find the time. This is just the Hitchhiker's Guide to the Linux Kernel.

Don't Kernel Panic!

[Bill Marczak @billmarczak]

Oh wow, remember the usbliter8 BootROM exploit that Paradigm Shift published about? Magnet Forensics (the GrayKey guys) allege that (1) Magnet products were exploiting it ITW(!) and (2) a former employee who went to work for Paradigm Shift leaked the details to them! 🤯

[Rithwik Jayasimha @thel3l]

In February, @rithvikvibhut and I started hacking fiber optic networks and a curious protocol called GPON.

We ended up with a way to see mobile traffic bc of 4G/5G backhaul, wiretap phone calls and build a massive botnet.

We're presenting at @defcon and @BlackHatEvents in Aug!

[Hex-Rays SA @HexRaysSA]

📢 IDA 9.4 is here!
Huge thanks to our beta testers for spending the last several weeks refining this release.

• The Apple Dyld Shared Cache workflow has been rebuilt from the ground up.
• The decompiler now speaks Swift, with proper ABI modelling for self, async context, and error paths.
• Two new processor modules land — Qualcomm Hexagon and MCore.
• Navigation gets a major upgrade with Pathfinder and a redesigned Jump Anywhere.
• The Teams add-on now runs on Git.
• And idalib, previously Pro-only, now ships with IDA Home.

👉 Read the blog for the full breakdown and/or jump ahead to the release notes, then grab your update in the Download Center.
https://t.co/hbo93SWxTM

[0xor0ne @0xor0ne]

Page Use-After-Free in Qualcomm's AI Accelerator kernel driver (qaic), full exploit writeup (Credits Lukas Maar)

https://t.co/sGJi5Y0YLF

#infosec

[The Hacker News @TheHackersNews]

⚡ New "Bad Epoll" (CVE-2026-46242) vulnerability affects #Linux 6.4+ kernels and may reach newer #Android devices.

It can turn a local user into root; the PoC hit 99% reliability and may trigger from Chrome’s renderer sandbox.

🔗 Read how the bug works: https://t.co/K7YzmGwZKm

[Nebula Security @nebusecurity]

Nebula Security is now backed by Y Combinator.

We’re celebrating by bringing you the world’s first Android 17 root demo — “IonStack”, a url click can let attacker fully control your phone.

This is not only an Android root demo. We’re bringing you a full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 and all Linux distros in 15 years. "IonStack" demonstrates how bad actors can control your phone by sending a malicious URL, but good news, Nebula Security found it before attackers do.

Both 0-day were found by our code scanning agent, VEGA, overshadowing any vulnerabilities found by Mythos or any scanner you name it.

VEGA has demonstrated its extraordinary capability in finding critical bugs in the world’s most complicated software: operating systems and browsers. It can spot the same vulnerabilities in your codebase too.

VEGA support full scan and incremental scan that can integrated into your CI/CD flow. We launched VEGA within YC companies and received overwhelmingly positive feedback. Now it is open to all enterprise customers in private beta.

Book a demo with us: https://t.co/eXHKhnE8gC

[Antithesis @AntithesisHQ]

If you think your bugs are old, @guanniqu talks about finding a 19 year old bug in the Linux Kernel: https://t.co/mCLr8IgKxZ

[Nicolas Krassas @Dinosn]

CVE-2026-20971: Samsung Android kernel UAF affecting Galaxy S9-S25 https://t.co/2FPAqMIa4t

[John Wu @topjohnwu]

I just published samloader-rs 2.0.0, with full firmware flashing capability!

Thanks to all of your kind words and support, it really meant a lot to me 😃

https://t.co/xGVcaVyWT0

[blackorbird @blackorbird]

Introducing usbliter8
An A12/A13 SecureROM exploit
A novel iPhone BootROM vulnerability discovered and exploited by our team. It covers the underlying bug, the associated exploitation techniques, and the post-exploitation steps required to achieve application processor's boot-chain compromise.
The exploit leverages both a hardware bug in the USB controller and a specific configuration flaw present in the device firmware.
https://t.co/pzRfe9j22y
poc:
https://t.co/a4D3H4xJvs

[GeoSn0w @FCE365]

The IMPOSSIBLE Happened! New iOS BootROM Exploit RELEASED (A12 & A13) - iOS 27 JAILBREAK Now Possible (usbliter8)

🤯 NEW VIDEO: https://t.co/mUJou1NBBZ

Similar to checkm8, it requires a USB, it can load firmware, PaleRa1n-like JB is now possible forever on iPhone 11, SE 2

[Hex-Rays SA @HexRaysSA]

⏱️ IDA 9.4 pre-release teasers start now.
First up: wider processor and platform support.

The upcoming release adds a Qualcomm Hexagon module, MCore and C-SKY V1, complete AArch64 SVE/SME, improved TriCore analysis with proper calling conventions, and expanded RISC-V coverage including Hazard3/RP2350 and new vendor extensions.

👉 https://t.co/uNlbm8SAB0

[Professor Larry Densel @luckyhacker43]

First public macOS kernel memory corruption exploit on Apple M5 🤯🔥

👨‍💻 Calif Team
🔗 https://t.co/UUMeELSA6c
🔗 https://t.co/c2BgqhjLHU

[Amit Sahu @ameetsaahu]

@maherazz2 Congrats!

[V4bel @v4bel]

🚨 Introducing "ITScape" (CVE-2026-46316)

A Guest-to-Host Escape in KVM/arm64. Guest-side actions alone exploit a use-after-free to run root-privileged code in the host kernel.

Unlike the commonly published QEMU escapes, the bug lives in in-kernel KVM, not QEMU. On a successful exploit, commands run with host kernel privilege rather than the privilege of a user process, threatening the guest-host isolation of multi-tenant arm64 public clouds.

To the best of public knowledge, the first Guest-to-Host Escape Exploit targeting in-kernel KVM/arm64.

Details: https://t.co/CtZOQEzIdg

[Amit Sahu @ameetsaahu]

@kuzeyardabulut But this method requires the TO_BE_CORRUPTED_RO_FILE to be opened solely in our process only, right? Otherwise MADVISE_DONT_NEED will not be able to evict the page cache?? I might be wrong, but surely would love to know.