DoubleMice

security researcher/vuln autoresearch

[Shubham Saboo @Saboo_Shubham_]

https://t.co/I00UtFrJdg

[Google VRP (Google Bug Hunters) @GoogleVRP]

📢 📢 📢 Calling all vulnerability researchers interested in microcode!

Check out our blog post covering EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.

https://t.co/gn4xvXwEsJ

[Matteo Rizzo @_MatteoRizzo]

https://t.co/JE68XbHamM
Our newest research project is finally public! We can load malicious microcode on Zen1-Zen4 CPUs!

[Mobile Security @mobilesecurity_]

Samsung S24: Out of bounds write in APE Decoder
#MobileSecurity #AndroidSecurity by @ProjectZeroBugs
https://t.co/I8mBWoiln4

[xvonfers @xvonfers]

[io_uring]
(CVE-2024-53187)
https://t.co/TQRZeftZjs

(CVE-2024-56584)
https://t.co/fzED56n4Rb

(CVE-2024-56709)
https://t.co/f95adls87s

[Klecko @klecko0]

I've written a post on SELinux and some public bypasses for Android kernel exploitation. It's especially relevant for Samsung and Huawei devices due to their use of hypervisors. Check it out here: https://t.co/UHesQZgjuv

[SpaceX @SpaceX]

Mechazilla has caught the Super Heavy booster!

[DoubleMice @real_doublemice]

@TripleZ666 成了

[DoubleMice @real_doublemice]

@FCE365 I won’t follow you anymore bro

[Faith 🇧🇩🇦🇺 @farazsth98]

It's been a long time in the making, but it's finally here - The Web3 ping of death: https://t.co/ItKJA6zPVq

[DoubleMice @real_doublemice]

@blckgrease @immunefi great

[Decurity @DecurityHQ]

.@Convergence_fi hacked for $200k! The vulnerable contract was deployed 17 days ago and was intended to distribute CVX rewards.
https://t.co/darqe1SgYc

[CertiK Alert @CertiKAlert]

#CertiKInsight 🚨

On 21 July 2024, @UPS_Official_ token UPS was exploited for ~$521K via a flash loan exploit.

Read our analysis of the incident here 👇

https://t.co/tXgqYOWdlG

[🚨 Cyvers Alerts 🚨 @CyversAlerts]

🚨ALERT🚨@Minterest has encountered a security breach on the #Mantle chain at https://t.co/4jsZyROxw3
Total Loss: Approximately $1.4M. The attacker was funded by @TornadoCash on the #ETH chain.
All stolen funds on the #Mantle chain have been bridged to #ETH.
Attacker's address: https://t.co/bHeGRI9rlc

Update from team:👇
Paused: Supply & Borrow
Active: Repay & Withdraw
The team is actively investigating the incident!

Want to keep your company off our alerts radar? Learn how to secure your assets: Book a Demo 🚀 https://t.co/qYomYZUVB1
#CyversAlert

[DoubleMice @real_doublemice]

@kagura_setsuki 在看呢在看呢

[Man Yue Mo @mmolgtm]

In this post I'll use CVE-2023-6241, a vulnerability in the Arm Mali GPU that I reported last November to gain arbitrary kernel code execution from an untrusted app on a Pixel 8 with MTE enabled. https://t.co/Flsas2jJtv

[Pedro Ribeiro @pedrib1337]

An extremely in-depth post about the Android Scudo allocator: https://t.co/fEKIgWdTK9

[Sudipta @chatsudi]

#Fuzz Every(5G)thing Everywhere All at Once : unleashed #5Ghoul (https://t.co/WYJzjIMHmH) - a family of 10+ 5G implementation vulnerabilities in @Qualcomm
and @MediaTek cellular baseband modems. Exploits as well as fuzzer is open source.
#5G #Fuzzing #Wireless #CyberSecurity

[xvonfers @xvonfers]

(CVE-2023-40088)
0-click RCE(Bluetooth, UAF in ~CallbackEnv)
com_android_bluetooth_btservice_AdapterService does not null its local JNI environment variable after detaching the thread, allowing UAF under certain conditions.
https://t.co/9PaM5GiciC

[DARKNAVY @DarkNavyOrg]

Exploiting the libwebp vulnerability (CVE-2023-4863) in Chrome. Our blog coming soon.