amon

infosec. The Potatosploiter of Nandy Narwhals. @[email protected]

[Renwa @RenwaX23]

Just dropping Firefox focus UXSS 0-day, critical 9.3 🔴

Disclosed this a year ago but it never got patched so... heres poc

[cts🌸 @gf_256]

hi guys here is universal account takeover for you to enjoy

[y198 @y198_nt]

Over the next few months, we'll be gradually publishing some of our internal security research.

Starting with a bug chain that turns Nginx-Rift + Nginx-PoolSlip into full RCE.

More to come.
#Nginx #1day #RCE
https://t.co/tqQMFAoX9P

[TrendAI Zero Day Initiative @thezdi]

Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[V12 @v12sec]

another day, another universal linux LPE

[starlabs @starlabs_sg]

We're likely 1st to publicly exploit crypto: af_alg as a new attack surface in kernelCTF. Our members @n0psledbyte & @st424204 started poking it in Sep 2025, finding a 0-day container escape unnoticed since 2011. @AnthropicAI @OpenAI: interested in collaborations? We are all ears

[Xint @xint_official]

Patch your Linux boxes!

https://t.co/VWOUDbLAn2 is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.

Found by the teams at @theori_io and @xint_official
More details below
https://t.co/9f6T96PvPX

[vx-underground @vxunderground]

Another zero day exploit released by some nerd (can't remember name right now) because they're annoyed with Microsoft. It's been confirmed by other nerds. It is yet another legit zero day. Whew.

https://t.co/Zllhns1ztn

[ptr-yudai @ptrYudai]

I participated in DiceCTF 2026 Quals and found cornelslop, a kernel exploitation challenge, especially interesting. Here is my writeup🍣
https://t.co/11fA2uyin9

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

100k bounty for CVE-2025-11460 heap use after free . the poc is public now in the report below, i just grabbed the video from this report

[Alex Plaskett @alexjplaskett]

Modern iOS Security Features – A Deep Dive by Moritz Steffin and @naehrdine

https://t.co/FRdenEEfqB

[Kirill Firsov @k_firsov]

A little morning research.
New React/Next.js CVE-2025-55183 Source code leakage PoC
Bypasses Cloudflare!
@FearsOff #react #bypass #cloudflare

[Gabriel Prostitis @___prosti]

stop using ubuntu 24.04 to host your kernel pwn challenges lmao
https://t.co/uCCNthelDn

[Bruce Chen @bruce30262]

Made a pwn challenge for this year’s HITCON CTF, which required participants to bypass PAC, BTI, and deal with relative vtables. Here’s the write-up:
https://t.co/5IrEynUF3T
Check it out if you're interested🙂

[Orange Tsai 🍊 @orange_8361]

Turns out my #PHRACK article is live! 🔥

> The Art of PHP — My CTF Journey and Untold Stories!

Kinda a love letter to those CTF players & PHP nerds! Hope all the credit goes to the right ppl. Also huge thanks to @0xdea for not forgetting me, @guitmz for the edits, and the @Phrack crew for keeping it real! 🎉

https://t.co/BMCLlHti7q

[tylerni7 @tylerni7]

LLM skeptics (or LLM curious folks) should read through @theori_io 's blog walking through what our LLM agents accomplished in #AIxCC (in testing before the contest) https://t.co/MfCwI0J42A you can just read the traces directly, but this points out some of the most fun :)

[amon @nn_amon]

Another great badge this year by @ANDnXOR!

#mattdamon #mainedoesnotexist

[&!^ @ANDnXOR]

It's 8PM in Maine, it's officially the weekend, we've 85% of our philanthropist badges. These won't last long: https://t.co/mxpo3hAfj1

[starlabs @starlabs_sg]

One of our current intern, @goatmilkkk shared his Chrome-atic escape adventure using CVE-2024-30088
Epic obstacles documented in it too!
https://t.co/pZH3WgQG91

[Alex Kuleshov @0xAX]

Apple’s Darwin OS and XNU Kernel Deep Dive https://t.co/mHRG050OpV