Anthony

All about security

[Zhenpeng (Leo) Lin @Markak_]

Containers are no longer a security boundary.

Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers.

As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from @depthfirstlabs and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported.

Read our full writeup: https://t.co/ZFSQCMCN73

[Vladislav Shevchenko @destr4ctt]

Finally got around to writing up CVE-2026-84530, which was fixed in the iOS 27 security release

This one is a kernel address leak in AIO subsystem - aio_workq_entry pointer gets left in kqueue metadata and can be read back from userspace

More details:
https://t.co/8qk7WYsiDz

[Taeyang Lee @5unkn0wn]

I gave a talk on Copy Fail at Off-by-One Conference 2026 last week, sharing how I approached the bug starting from 1-day analysis, discovered and exploited its variants, eventually found Copy Fail, and my chain of thought throughout the research.

It was a great experience!

[L0Psec @L0Psec]

When attaching DMG, there is a scpt file of interest with JXA. We can decompile this and see the code.

[Linux Kernel Security @linkersec]

CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel

Paper by Dong-ok Kim, Juhyun Song, et al. documenting the steps for executing a cross-cache attacks for caches with min_partial >= cpu_partial_slabs.

https://t.co/IsZAzZh83g

[Rick de Jager @rdjgr]

Interestingly this is a very similar primitive to one of the "unexploitable" dead ends in @trailofbits recent article about sandbox escapes. (although this is a slightly different bug)

It did take some manual nudging for me to convince 5.6-sol that AppArmor could be bypassed :)

[Shawn Bass @shawnbass]

This new version is so dope! An absolute must have for MacOS!

[zhiniang peng @edwardzpeng]

Sharing my for keynote talk for Offbyone security conference #OB12026 : <A year of hacking with LLMs>

https://t.co/W7NFSnAvij

[PT SWARM @ptswarm]

🍏 Fresh LPE in macOS: Repair Permissions - Get Root!

CVE-2026-43783 found by our researcher Ilya Andr (@andrd3v) has been recently fixed by Apple. A single XPC request to DesktopServicesHelper lets you chown any path on disk - straight to root.

👇👇👇

https://t.co/IESxjGmkVH

[Farenain @Farenain]

I have spent some time improving my tool dragon-tales, and asking @claudeai to help me with an analysis of VMProtect in a small binary protected with virtualization. The idea was using methods like the ones proposed by @qb_triton @aftermath_labs and SATURN

[xvonfers @xvonfers]

(CVE-2026-87491)[543557673][wasm][sandbox]OOBW, exploited ITW
https://t.co/KWWQktA11F

PoC:
https://t.co/bSoPIBr19B

Reported by Jihyeon Jeong:
https://t.co/17rcGQx3TE

[ONE Jailbreak @onejailbreak_]

📣CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71) by @ByteV0rtex

https://t.co/eCInGlTMRx

[Cyber Meowfia @cybermeowfia]

Today's exploit is for the latest Ubuntu 26.04, a UAF in netfilter: CVE-2026-72255.

It was introduced in Sep 2014 and fixed upstream in Jun 2026.

Discovered and exploited by the NebuSec security pipeline (Including AppArmor bypass).

Exp source code: https://t.co/BbwPXMiXIH

[Cyber Meowfia @cybermeowfia]

Today's exploit is for the latest Debian, an OOB in mpls: CVE-2026-43042.

It was introduced in Mar 2015 and fixed upstream in Mar 2026.

Discovered and exploited by the NebuSec security pipeline.

Exp source code: https://t.co/TR4Tbap62D

[Cyber Meowfia @cybermeowfia]

Today's exploit is for the latest Debian, a UAF in netfilter: CVE-2026-80714.

It was introduced in Jul 2010 and fixed upstream in Jul 2026.

Discovered and exploited by the NebuSec security pipeline.

Exp source code: https://t.co/d7p8pHR5dF

[Alex @xaitax]

This is what I built to get me there: my Windows EoP research-to-exploit harness, specialised for Codex and Daybreak, with RCE support in progress. Based on my own research experience and OpenAI's guidance. Skills, specialist agents, persistent state, behavioural evals, and full exploit-chain validation. It works surprisingly well. I may release it in Q4.

[Alexandre Borges @ale_sp_brazil]

That’s the third vulnerability in iOS 27 beta 7 this week, though only one was submitted to Apple (business decisions), which is the simplest one. In any case, my admiration for the iOS architecture and engineering only grows by the day.

#vulnerability #ios #apple

[0xSero @0xSero]

This is true, however prefill on Mac sucks.

Instead of waiting for token generation you’re going to be waiting for prompt processing

[Hyungyu Seo @wh1te4ever]

https://t.co/iBhy2JmrYh

I'm finally sharing my xnu_1day_practice project.
It documents I've studied on my own over the past year ..

Feel free to check it out if interested in researching XNU kernel vulnerability.

[NebuSec @nebusecurity]

Today's exploit is again for the latest Ubuntu 26.04, a UAF in SCTP: CVE-2026-68162.

It was introduced in Jan 2025 and fixed upstream in Jul 2026.

Discovered and exploited by the NebuSec security pipeline.

Exp source code: https://t.co/vCpwTZR3Ql