nevul37

Windows Security Researcher 😉

[Microsoft Security Response Center @msftsecresponse]

Update to the Windows Insider Preview bounty program: General Awards for Elevation of Privilege and Information Disclosure are now split by finishing privilege, with award ranges increasing to $1,000–$8,000.

This change is designed to better align rewards with the impact of reported vulnerabilities.

Learn more on the Windows Insider Preview bounty page: https://t.co/Vr0pvfcEOi

[Hwiwon Lee @hwiwonl]

We’re happy to release 𝐒𝐄𝐂-𝐛𝐞𝐧𝐜𝐡 𝐏𝐫𝐨: a benchmark for measuring the bug-hunting capabilities of AI agents in critical software systems such as Chromium V8, Firefox SpiderMonkey, and more.

Explore the details here: https://t.co/gIMnS4Oohx

[ENKI WhiteHat @ENKI_official_X]

[1/2]
CVE-2026-32223: heap overflow in usbprint.sys (IOCTL 0x220064).

Malformed USB descriptor, Named Pipe spray + Ghost Chunk for kernel leak, forged IRP, SYSTEM.

Writeup: https://t.co/EMSyWCPsVL

#CVE_2026_32223 #WindowsKernel #LPE #vulnresearch

[nevul37 @nevul37]

@eternalsakura13 @offensive_con cool 😀

[OtterSec @osec_io]

We recently achieved guest-to-host escape by exploiting a QEMU 0day.

We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.

Writeup coming next week.

[Lingming Zhang @LingmingZhang]

🤯🤯🤯 Gemini 3 Pro + Live-SWE-agent hits 77.4% on SWE-bench Verified, beating ALL existing models, including Claude 4.5!!

🤖 Live-SWE-agent is the first live software agent that autonomously self-evolves on the fly — and it even outperforms the manually engineered scaffold used by the Gemini 3 Pro team (76.2%)

[nevul37 @nevul37]

@Jiri123_eth @OpenAI what

[chiefpie @cplearns2h4ck]

Some more of my bugs in Hyper-V are patched in this month's update. I'm able to exploit it to elevate privileges on the last 10 years of Windows. Also seems like more researchers are targetting this component now.

[Yarden Shafir @yarden_shafir]

Ever wanted to debug the secure kernel but couldn't figure out how? Me too. It's awful.
But I eventually got it working and managed to do some cool stuff, so I documented my solutions here in case it helps anyone else: https://t.co/qvlH3s2XcF

[Seokchan Yoon / 윤석찬 @_seokchan_yoon]

How to reach the CTF finals

Other CTFs: study hard and grind to capture the flag
@Blackhatmea CTF: just trade flags 🥵☠️☠️☠️

[那个火饺🦆(JJ) @thatjiaozi]

Here is the PoC of the exploit for cve-2025-30712 as well as some of the code for the fuzzer i created to find the bug!

https://t.co/g82641DT2I

[xvonfers @xvonfers]

Whoah... $250000

(CVE-2025-4609, similar to CVE-2025-2783/412578726)[412578726][Mojo][IpczDriver]ipcz bug -> renderer duplicate browser process handle -> escape sbx is now open with PoC & exploit(success rate is nearly 70%-80%)
https://t.co/KiQ6gHaHVj
https://t.co/5TXy8yIC0g

[Alan Sguigna @AlanSguigna]

Here are the links to the recordings of my prior two webinars:
Debug of Hyper-V, Secure Kernel, VBS Enclaves, Defender, and other secrets: https://t.co/6moS4UdFWC
and Advanced Threat Analysis and Reverse Engineering using AI: https://t.co/BGkNXYzCnx

[ENKI WhiteHat @ENKI_official_X]

Curious how the Codegate 2025 FullChain was meant to be pwned? From RCE to SBX to LPE... the path to SYSTEM is now public. Official write-up is live! #pwn #CTF #Codegate #RCE #SBX #LPE

https://t.co/9p7wUFCjnI

[DirectoryRanger @DirectoryRanger]

Windows Inter Process Communication – A Deep Dive Beyond the Surface, by @haider_kabibo
Part 1 https://t.co/WXPXxYwlbm
Part 2 https://t.co/vdZcjzy0J1
Part 3 https://t.co/Xymk9LDsCR
Part 4 https://t.co/zmAGonxDMj
Part 5 https://t.co/rUOLhwY1Sr

[nevul37 @nevul37]

My ranking changed from 26th to 22nd with 662.5 points earned over the past year.
I placed 8th in the Windows category, collaborating with @develacker on the SEC-agent team.

Thanks to @msftsecresponse for the update, and to @ENKI_official_X for the support.

[Microsoft Security Response Center @msftsecresponse]

Our previously published Most Valuable Researchers (MVR) leaderboard contained inaccuracies due to technical issues on our end. We apologize for the error and have since resolved the issue. We’re now sharing a fully refreshed and accurate leaderboard.

The Microsoft Researcher Recognition Program offers public thanks and recognition to security researchers who help protect our customers by discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure.

We are excited to recognize this year’s Most Valuable Researchers (MVRs), based on the total number of points earned for each valid report. Please join us in celebrating this year’s MVRs, including our top 10:
1. 🥇wkai
2. 🥈VictorV (@vv474172261)
3. 🥉Suresh Chelladurai
4. Anonymous
5. Brad Schlintz (@nmdhkr )
6. @0x140ce
7. Anonymous
8. Dhiral Patel (@dhiralpatel94)
9. Nan Wang (@eternalsakura13) and Ziling Chen
10. Adnan (@adnanthekhan)

See the full list of this year’s MVRs, in addition to our Azure, Office, Windows, and Dynamics 365 leaderboards: https://t.co/zlTjhLunQY

#bugbounty

[Microsoft Security Response Center @msftsecresponse]

Congratulations to all the researchers named to this year’s Most Valuable Researchers (MVR) list, including: @vv474172261 @adnanthekhan @dhiralpatel94 @eternalsakura13 @0x140ce @4zure9 @KeyZ3r0 @nmdhkr @edwardzpeng @haifeili @thezdi @nevul37 @Xtytia0922 @scwuaptx @the1bernard @wh1tc @ycdxsb @Panther82Black @sim0nsecurity @Fatnass1F1ras @shhnjk @yuvalavra @crispr_x @scianto05 @niraj1mahajan @filip_dragovic @nvk0x @ashketchum_16 @guilhermesgi @c0d3nh4ck

[ptr-yudai @ptrYudai]

CODEGATE CTF 재미있었어요. pwn가 너무 어려웠어요.
저는 Chromium RCE 와 Windows LPE 두 문제만 풀었어요.
SBX가 풀리지 않아서 슬퍼요.
운영 여러분 감사합니다！

[nevul37 @nevul37]

🔥🔥🔥

[Microsoft Security Response Center @msftsecresponse]

Congratulations to all the researchers recognized in this quarter’s MSRC 2025 Q2 Security Researcher Leaderboard! Thanks to all the researchers who partnered with us for your hard work and continued dedication to securing our customers.

Learn more in our blog post: https://t.co/3xo0rk87zI

We also want to recognize the top 10 researchers in the leaderboard:
🥇wkai
🥈Brad Schlintz (@nmdhkr)
🥉@0x140ce
🥉 Zhiniang Peng (@edwardzpeng) with HUST & R4nger (@R4nger99) with CyberKunLun
5. VictorV (@vv474172261)
6. k0shl (@KeyZ3r0)
7. @wh1tc @ Kunlun lab& devoke & Zhiniang Peng (@edwardzpeng) with HUST
8. Jongseong Kim (@nevul37), SEC-agent team
9. Anonymous
10. Haifei Li (@HaifeiLi)
10. Nick Wojciechowski

[ENKI WhiteHat @ENKI_official_X]

Enki WhiteHat has detected activity where Kimsuky abuses GitHub as attack infrastructure.

Private GitHub repositories are accessed using PATs, leading to XenoRAT deployment.

See the full attack flow and the details of how Kimsuky approaches its victims:
https://t.co/WXfck17NHF

#APT #Kimsuky