Brian Pak

ai + security + alpha
CEO @theori_io / @xint_official → building the world's best AI hacker
9x DEF CON CTF winner
CMU CS '11 | founded PPP & MMM

[Brian Pak @brian_pak]

@orange_8361 What a legend. Always respect for your 1337 skills.

[Brian Pak @brian_pak]

Funny enough, Xint *did* find it as well. It was just buried in many other bugs that we didn't get to triage / report manually yet. Interesting part is that it's auto-triaged not as important as Copy Fail bug because it needed user namespace (which requires root in Ubuntu), and didn't reason about chaining RxRPC. Definitely needs some work on our auto-triager + exploit technique skillz.

[Brian Pak @brian_pak]

We’re grateful to the kernel security team and everyone working hard on patches. Looking ahead, we’re sure Xint and our researchers will uncover many more critical vulnerabilities. We’ll try our best next time to create less chaos for folks. Happy to discuss improvements openly.

Thanks for reading. Let’s keep making Linux stronger together. 🙏

[Brian Pak @brian_pak]

Hey everyone. We’ve seen the discussions around Copy Fail (CVE-2026-31431) and the disclosure process. We appreciate the passion from distro maintainers, defenders, and the broader Linux community. This is a serious issue, and we want to share some context on our side in good faith. 🧵

[Brian Pak @brian_pak]

Some have also raised concerns about us releasing the exploit publicly. We have experience writing N-day exploits and know that monitoring git commits for fixes is common practice in offensive security. Attackers were likely already aware and exploiting this within the a few days after the kernel fix landed. With AI coding tools today, turning a CVE plus commit into a working exploit happens in hours anyway.

[Brian Pak @brian_pak]

@5unKn0wn Real GOAT has spoken.

[Dino A. Dai Zovi @dinodaizovi]

This is an absolutely *beautiful* bug

[Brian Pak @brian_pak]

interestingly, not fuzzing. xint code reviews the code, reasons about potential vulnerabilities, and validates the theory, all in static analysis fashion. it is possible to hook up with the dynamic testing to be even more certain about the validation; but it already does pretty good job of weeding out false positives.

[Brian Pak @brian_pak]

Time to talk about this one.

CopyFail (CVE-2026-31431) — a 732-byte Python script that roots every Linux distro shipped since 2017. 🧵

[Brian Pak @brian_pak]

a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9 👀

[Brian Pak @brian_pak]

I promise the bug is real, tho

[Brian Pak @brian_pak]

and yes, RHEL 14.3 doesn't exist 😅 We meant to say RHEL 10.1. Sorry for the confusion!

And also yes, the static webpage https://t.co/RgEXCiqzE5 -- even the logo -- is vibe-coded. Too busy triaging shit ton of other bugs to build a legit website ground up.. and i think it's a perfect use case of vibecoding tbh 😆

[Brian Pak @brian_pak]

@msolnik oops. should be public now! sorry about that.

[Brian Pak @brian_pak]

@5unKn0wn https://t.co/FcBMTZdV0I

[Xint @xint_official]

Patch your Linux boxes!

https://t.co/VWOUDbLAn2 is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.

Found by the teams at @theori_io and @xint_official
More details below
https://t.co/9f6T96PvPX

[Brian Pak @brian_pak]

Surfaced by Xint Code — our AI vuln research platform — pointed at the kernel's crypto/ for about an hour, on a starting hunch from @5unKn0wn.

Came back with CopyFail (plus others, still in coordinated disclosure).

Write-up + PoC (exploit): https://t.co/RgEXCiqzE5
Xint Code: https://t.co/BDYUap5huu