Andrey Lovyannikov

[Nebula Security @nebusecurity]

Since V8 had heap sandbox, Chrome renderer RCE usually means chaining 2 bugs

Today we bring the Spear of Longinus
1 bug, 100% success, no heap spray, found in 40+ major versions, arbitrary renderer read/write + V8 sandbox escape

Our CVE-2026-6307 writeup https://t.co/zPnCJ4y0R3

[blackorbird @blackorbird]

Introducing usbliter8
An A12/A13 SecureROM exploit
A novel iPhone BootROM vulnerability discovered and exploited by our team. It covers the underlying bug, the associated exploitation techniques, and the post-exploitation steps required to achieve application processor's boot-chain compromise.
The exploit leverages both a hardware bug in the USB controller and a specific configuration flaw present in the device firmware.
https://t.co/pzRfe9j22y
poc:
https://t.co/a4D3H4xJvs

[V4bel @v4bel]

🚨 Introducing "ITScape" (CVE-2026-46316)

A Guest-to-Host Escape in KVM/arm64. Guest-side actions alone exploit a use-after-free to run root-privileged code in the host kernel.

Unlike the commonly published QEMU escapes, the bug lives in in-kernel KVM, not QEMU. On a successful exploit, commands run with host kernel privilege rather than the privilege of a user process, threatening the guest-host isolation of multi-tenant arm64 public clouds.

To the best of public knowledge, the first Guest-to-Host Escape Exploit targeting in-kernel KVM/arm64.

Details: https://t.co/CtZOQEzIdg

[Black Hills Information Security @BHinfoSecurity]

**NEW** BHIS | Blog
(It's 10pm. Do you know where your pipelines are?) How well do you know your Continuous Integration/Continuous Delivery (CI/CD) pipelines?

Auditing GitLab: The CI/CD Kill Chain
by: @ProOfConcept9
Published: 06/03/2026
Learn more: https://t.co/mHZIe71cjs

[0xor0ne @0xor0ne]

Bypassing Linux kernel CR pinning to execute shellcode by placing a KProbe in the native_write_cr4 instruction gap.

https://t.co/ZNFonMc5Og

#Linux

[Hamid Kashfi @hkashfi]

Here's the PoC for Nginx CVE-2026-42945 which works against vanilla Ubuntu (and any other distro?) + Nginx with ASLR enabled. I have included all iterations of the PoC the LLM was kicked to improve.

TL;DR: We can use an LFI/file-read primitive to leak enough details from /proc/<nginx-worker>/mem to bypass ASLR and achieve reliable RCE, in most cases at first shot.

There are still other ways to make it work, with even less subtle primitives. If you ask Geppetto nicely, he will help you ;)

https://t.co/VawjqrMisN

[striga @striga_ai]

PoCs for Apache Tomcat Unauth RCE (CVE-2026-34486) and Apache httpd Pre-auth RCE (CVE-2026-23918) are now public on our Github.

Tomcat exploit is fully reliable. httpd chain works in a controlled lab setup with a known info leak.

https://t.co/D3dg5iTuwP
https://t.co/2zyr1ds4Mo

[V4bel @v4bel]

💥 Introducing "Dirty Frag"

A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.

No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.

Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.

Details:
https://t.co/9nqku4svkY

[Adrián Díaz @s4dbrd]

Wrote up my first Patch Tuesday diff. CVE-2026-20811, type confusion in win32kfull.sys. CMonitorTopology* survives incomplete sanitization in the async path.

Feedback welcome!

https://t.co/jac0MwNu4U

[Lan Vu 🇻🇳 @lanleft_]

Check out my latest blog post. I hope you all enjoy it
👉👈

https://t.co/nCs4nxFihx

[wrongbaud @wrongbaud]

JTAG Deep dive for reverse engineers:

https://t.co/EI5OSDN8GN

https://t.co/zzVZnelFZq

[0xor0ne @0xor0ne]

Arbitrary kernel read/write in QEMU via broken iret/call far instruction handling, with KASLR and kPTI bypass

https://t.co/wfHSaIiDsz

#infosec

[Gadi Evron @gadievron]

Access it here:
🔗 https://t.co/R15fbezGK7

Thank you Rob and team for stepping up, and helping make the conference what it becam

[Chris Wysopal @WeldPond]

The window between vulnerability disclosure and real-world exploitation keeps shrinking.

The Zero Day Clock visualizes how fast attackers are operationalizing new CVEs. What used to take months now often happens in days, or hours.

The future needs to be Secure by Design.

https://t.co/zFXOSKB7eq

#AppSec #CyberSecurity

[Tim Blazytko @mr_phrazer]

Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others.

Here's the release: https://t.co/HU2Vf8Uj6T

[Mathy Vanhoef @vanhoefm]

We found that Wi-Fi client isolation can often be bypassed. This allows an attacker who can connect to a network, either as a malicious insider or by connecting to a co-located open network, to attack others.

NDSS'26 paper: https://t.co/MI567gb2Jr
GitHub: https://t.co/Ns9nn9JEZM

[Andrey Lovyannikov @Dil4rd]

CLI tool: https://t.co/C7MLID2X7b

Individual crates for your own craft:
- Apple DMG (UDIF) https://t.co/WFsU4y88Td
- HFS+ and HFSX Filesystems https://t.co/KxykGNRSPx
- Apple File System (APFS) https://t.co/0QXNXTs1gn
- XAR archive https://t.co/EAvgkIpLlz
- PBZX archive https://t.co/pEFWcIBSEI

[Andrey Lovyannikov @Dil4rd]

Meet dpp — a pure Rust pipeline to navigate Apple DMGs. It parses everything from the UDIF wrapper down to the PBZX payload.

• Usability: 100% cross-platform (macOS, Linux, Windows)
• Performance: Parallel decompression (beating 7z) & low memory footprint
• Safety: Zero unsafe blocks
• Design: Modular crates (UDIF, XAR, APFS, etc.) + Python bindings 🐍

Perfect for CI/CD, security research and forensics.

https://t.co/5fyWLbNXQ0

[kqx @kqx_io]

How a single typo led to RCE in Firefox

Can you spot the bug?

Read now at: https://t.co/fr6Z6gW8bw

[Ahmet Barut @ahmtbrt07]

very important resource for fuzzing. Definitely read it

https://t.co/WbltmcF9v1

#fuzzing #BugBounty #ethicalhacking #zeroday