Early this week, we had a meeting at Apple Park in Cupertino. While there, we also shared with Apple our latest vulnerability research report: the first public macOS kernel memory corruption exploit on M5 silicon, surviving MIE. It was laser printed, in honor of our hacker friends.
Full story: https://t.co/AmKMGUmWPt
Did you know that running Chromium with these two flags --disable-web-security & --single-process ANY website can access your local files.
https://t.co/N8OBX7Q2Hn
I am actually very interested in puzzle design! I spent some time a few years ago working on https://t.co/qkxvMNWCz1 which (I hoped) would help CTF authors write non-guessy challenges. So I decided to make a "exploratory" style challenge (a collection of a few easy problems) 7/🧵
So this happened a couple of months ago, but we reported an account takeover - in a multimillion users entertainment platform - that earned us $4,500 (Collaborated with @Mr_nyly & @S0nG0ku_H). since it's a private program, I can't disclose a thing, but here are some takeaways 👇
IP whitelisting is fundamentally broken. At @assetnote, we've successfully bypassed network controls by routing traffic through a specific location (cloud provider, geo-location). Today, we're releasing Newtowner, to help test for this issue: https://t.co/X3dkMz9gwK
🔥 A new (more difficult) era for mXSS will come soon! If nothing breaks, Chromium will start escaping "<" and ">" in attributes starting with M138.
See https://t.co/lXfe86tpmd for details.
New blogpost! Want to see how we exploited @Synology network-attached-storage devices at Pwn2Own Ireland?
RCE to root via out-of-bounds NULL-byte writes, click the embed for a fun little writeup of CVE-2024-10442 🔎🎉
https://t.co/VOhC5NSCat
Introducing Deep Research for arXiv
Ask questions like 'What are the latest breakthroughs in RL fine-tuning?' and get comprehensive lit reviews with trending papers automatically included
Turn hours of literature searches into seconds with AI-powered research context ⚡
Just finished my writeup about CVE-2025-23369, an interesting SAML authentication bypass on GitHub Enterprise Server I reported last year. you can read about it here: https://t.co/Ee61EoACtE