four0four

Student | Security Researcher | CTFs with @ARESxCTF, @malta_ctf

[OtterSec @osec_io]

New research: We were able to access camera permissions and obtain user GPS coordinates across 20+ major mobile wallets by exploiting WebView misconfigurations. Here's how ↓

[SSD Secure Disclosure @SecuriTeam_SSD]

See how a single race condition led to renderer RCE.
In our new article, we examine a high-severity TOCTOU bug between Blink and V8's WebAssembly compiler that allowed a benign module to pass validation while a malicious one was compiled. Because the Wasm JIT pipeline resides outside the V8 heap sandbox, this resulted in renderer RCE without requiring a V8 sandbox escape.
Read our full analysis: https://t.co/goryCX6yQs

[RewriteLab @RewriteLab]

We published a new research article on the Chromium 146 Renderer Process!

In this article, we start from the CVE-2026-3910 Maglev write barrier elision bug and walk through the full exploit chain: building a V8 heap R/W primitive via a GC-induced UAF, achieving an out-of-sandbox read using WebAssembly internals, abusing JSPI UAF and StackMemory / JumpBuffer, and ultimately reaching renderer process RCE.

Our goal was to provide a structured explanation of how modern V8 exploitation works in practice, from compiler-level bug analysis to sandbox-boundary primitives and final code execution. Huge thanks to our team member @m411k_ for conducting this research!

Check out the PoC!

Full article:
https://t.co/qezGcrklC1

[ARESx @ARESxCTF]

ARESx has quallified to greyctf finals!!🇸🇬🇸🇬

Thank you @NUSGreyhats for hosting the quallifiers, we look forward to seeing everyone in singapore! 🚀

67

[ProjectDiscovery @pdiscoveryio]

New engineering blog:

How @neo_ai_engineer's agent architecture evolved from one agent to plan → execute → verify.

What worked, what broke, what we learned building agentic tooling for real security work.

https://t.co/hQVbq9nwsa

[Masato Kinugawa @kinugawamasato]

A trivial bypass was fixed in DOMPurify 3.2.5 (https://t.co/anfo1wseaD). It works only if an attacker can write "-->". DOMPurify usually tries to prevent you from writing "-->" on attributes, but it can be written through DOMPurify hooks in some cases, for example. PoC👇

[Ambionics Security @ambionics]

🔓 On an asset under our continuous monitoring, our pentester @nol_tech turned a SELECT-only PostgreSQL SQLi in Drupal (CVE-2026-9082) into a full RCE when DB role is superuser. Details below 👇
📝 https://t.co/R7F5XQ2vZD
🛠️ https://t.co/yRJ8zX1Nlb
#Drupal #PostgreSQL #RCE #SQLi

[Jorian @J0R1AN]

I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer!
The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below:
https://t.co/nY20Anz0VO
(and thanks @garethheyes for making Shazzer!)

[Renwa @RenwaX23]

"Dad, what was it like playing CTFs before AI?"

[tylerni7 @tylerni7]

Despite how much has changed, it's shocking to see how much of our original designs/learnings from 2+ years ago are still relevant now. It's fun to look at old blog posts + code as artifacts from "long ago": https://t.co/dRh0bVW8hC https://t.co/jHEWAuDiKF https://t.co/DN94jFFUcq

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[hashkitten @hash_kitten]

Thanks everyone for playing! I talk about the solution here, as well as how I discovered this behavior while looking into the Chrome Sanitizer API: https://t.co/sJFM83OOFG

[Jopraveen @jopraveen18]

people are too busy in exploring chrome, kernel and other oss CVEs,
meanwhile a DOMPurify bypass was silently dropped 👀

https://t.co/OCzsMzrQ1t

[TrendAI Zero Day Initiative @thezdi]

That's a wrap on Pwn2Own Berlin 2026! 🏆 $1,298,250 awarded. 47 unique 0-days. 3 days of absolute chaos. And talk about main character energy - congrats to DEVCORE for claiming Master of Pwn with 50.5 points and $505,000 - they never slowed down. See you next year! #Pwn2Own #P2OBerlin

[Orange Tsai 🍊 @orange_8361]

And this one is human insight w/ LLM-assisted research. Took about one week to finish everything. The AI really rescued me from a lot of tedious work

— excluding the part where it changed the Domain Admin password, locked me out, and claimed it got RCE 🤦

[PT SWARM @ptswarm]

🐘 PHP JPEG bugs: how image parsing leads to memory corruption.

Our researcher Nikita Sveshnikov discovered two JPEG-related memory-safety bugs in PHP’s ext/standard: CVE-2025-14177 in getimagesize and a heap buffer overflow in iptcembed.

https://t.co/WCQWlfuPZl

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[AmirMohammad Safari @AmirMSafari]

I wrote this story in a blog post, starting with my old challenge and leading up to this point. Chromium has since patched this attack vector. The full post is linked below, hope you enjoy reading it ;)

https://t.co/cRm6YTGAND

[ARESx @ARESxCTF]

ARESx is proud to announce that we have placed 5th on Lake CTF in Lausanne🇨🇭

Thanks to the organization for the great event @LakeCtf and hope to see everyone soon!! 🚩🚀

[four0four @f0ur0four]

A little late but here it is :-)
I qualified for Dreamhack Invitationals '26 Finals and had the privilege of going to Seoul 🇰🇷 to participate in the finals. A huge thanks to @dreamhack_io for the invitation and for the great hospitality. I had an awesome time participating!