‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.
Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.
▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.
Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.
Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.
ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.
Decoding a Cobalt Strike Loader with Cyberchef and Emulation
A short video looking into a common CS loader and methods for extracting C2 addresses from Shellcode 😁
https://t.co/2DY4hgNw1k
#Malwareanalysis#Cobaltstrike
detailed analysis of the BLISTER Loader along with a config extractor h/t @DanielStepanic@soolidsnakee and MARE team
https://t.co/slJZ8g0huM
https://t.co/R65utJNvzv
Some Detections for this IR report
https://t.co/hGZLzekBCl:
https://t.co/Y3BvgeInbG
https://t.co/9BUpvMjSKE
https://t.co/wRfQ8jxzQu
https://t.co/KryLkzNEaO
https://t.co/DrfDvWTkiy
https://t.co/bGZXazMFJQ
Hello #DFIR people,
since i often have to look up event IDs when doing analyses, i have structured my bookmark collection a bit and put it into a repo. Not much so far. And since that's how you do it today, I hope it turns into an awesome collection.
https://t.co/IJCMp6dC6o