Shadow Chaser Group

Shadow Chaser Group is a sub-group of the GcowSec team which consists of college students who love it.Shadow Chaser Group focused on APT hunt and analysis

[Shadow Chaser Group @ShadowChasing1]

Hi,bro
Shadow Chaser Group is a sub-group of the GcowSec team which consists of college students who love it.Shadow Chaser Group is focus on #APT hunte and analysis
I hope you will follow us :-)

[NebuSec @nebusecurity]

We're thrilled to have contributed a V8 vulnerability to one of this year's four $250K Chrome full chain exploits. The vulnerability was subtle enough that Google needed multiple commits to finally fix it.

However, we would like to take a step further. To convince Fortune to smile upon us deterministically. We managed to use LLM-assisted formal verification to rediscover the bug. The same approach can prove security properties of functions and APIs.

Will share writeup and more about formal verification work soon. We will build more Chrome full chains!

[NebuSec @nebusecurity]

Muse is cute, until it isn’t.

Stay tuned.

[NebuSec @nebusecurity]

Remember when scam callers only ask for your password? Good times.

Now picking up a wrong call can get you hacked.
Telegram RCE discovered by NebuSec Code Security, powered by GPT-5.4.

Yes, GPT-5.4. We turned a dinosaur model into a cyber powerhouse.

Fixed in Telegram Android 12.10.4（7099)

[Ziyi Guo @tripleh_life]

"Bad UVM" - Privilege Escalation, Container Escape via NVIDIA GPU UVM - hijack read-only page cache.

More details: https://t.co/WUQpTH5HH1

[NebuSec @nebusecurity]

Proxmox VE 7.x authentication bypass (pre-auth RCE)

[NebuSec @nebusecurity]

Fixing carbon buildup in a turbocharged engine might cost you $55,000. Here is how we exploited a flaw we found in Google V8's Turboshaft.

We received reports that this vulnerability was exploited against some products. Make sure your Chromium is up to date. Writeup below.

[NebuSec @nebusecurity]

25 elite hacking teams raced in the final kernelCTF. NebuSec closed out the history of the classic kernelCTF with 99% exploit stability, 0.1s exploit time, and 0.000461s submission time.

We’ll soon open-source our kernelCTF infra and a walkthrough of how we won every kCTF we entered, and pushed our time cost down to the absolute minimum.

[NebuSec @nebusecurity]

CVE-2023-2156 was believed to be just a remote kernel DoS, patched in 2023.

We found a bypass and achieve privilege escalation and container escape.

Read the $10,500 story of CVE-2026-43501 "Route of Root":
https://t.co/SnveNORatM

[NebuSec @nebusecurity]

Amazing work.

[NebuSec @nebusecurity]

We’ve open-sourced one-click Docker setups and full exploits for Nginx-{PoolSlip, QuicBurst}, both with remote ASLR bypasses.

Try them here:
https://t.co/qx0TiXc9jk

PoolSlip's OOB write leaks ASLR data extremely fast, while QuicBurst's UAF takes longer.

[NebuSec @nebusecurity]

Here's the final chapter of our IonStack series, the Android rooting part.

Including how we use GhostLock (CVE-2026-43499) to defeated KASLR on Android and bypassed KCFI to get arbitrary kernel memory read and write:
https://t.co/p14D2qAdft

[NebuSec @nebusecurity]

We can easily find more vulnerabilities, the reason we didn't do that is simply we don't have enough people to patch them all.

During our first scan in Feb, we found 600+ vulnerabilities in Linux kernel and till nowadays 100+ patches were merged and we are still fixing the rest of them...

[NebuSec @nebusecurity]

After the Hugging Face incident, have you wondered how easy it is to escape a modern agent sandbox?

We benchmarked eight open-source agent sandboxes to show how vulnerable they can be, and why frontier models can break out so easily. https://t.co/gkwdNz0wKT

[crazyman @crazyman823886]

Do you enjoy vibe-coding piles of open-source software that nobody uses? Shipping self-indulgent products and wondering why nobody else seems impressed? Want to know what someone outside your own head might think of your product? https://t.co/ZTrR6jOiMF

[NebuSec @nebusecurity]

Watch us open the camera and uncover the anonymous identity behind Tor browser:

We published the writeup for the browser RCE in IonStack. Mythos reported 271 bugs in Firefox 150 but still missed this one. And the Tor Browser is also affected by CVE-2026-10702.

Update your Tor!

[NebuSec @nebusecurity]

We won kernelCTF again with a new 0-day vulnerability and eligible for another $100k bounty

[NebuSec @nebusecurity]

Try a live IonStack root on your Pixel 10: https://t.co/EkOrNlQ5ew

In the IonStack demo, we left the rootme URL visible and put up a giant countdown as a tribute to jailbreakme.

[NebuSec @nebusecurity]

GhostLock (CVE-2026-43499) is a 15yr old kernel 0-day we used in IonStack full chain exploit.

Everything around you, as long as it runs Linux, from IoT to mobile to desktop, is affected.

Read how we won $92,337 bug bounty with GhostLock and see our exploit on Github. Link below

[Qyn @qynln]

For this (maybe last) year of SekaiCTF I made a fullchain challenge, chaining together an 0-day in ladybird/libjs, an 0-day qemu TCG LPE and a n-day qemu escape:

https://t.co/w8KbB5EUMg

We also re-released another challenge with a running bounty until next week!

[r3kapig @r3kapig]

R3CTF 2026 has come to a successful close. Please join us in congratulating this year’s award-winning teams!

🥇 BBBB
🥈 EQST
🥉 @ProjectSEKAIctf

Thank you to our sponsors @nebusecurity @osec_io @zellic_io @vector35 @googlecloud

Hope see you next year!