![LxlxIxlxlxL's tweet photo. pkexec ships SUID-root on every major Linux distro. it had a local root exploit in its very first commit, May 2009, hidden for 12 years. CVE-2021-4034, "PwnKit".
the bug isn't a clever overflow. it's what happens when you assume argc is never 0.
execve lets you run a program with an empty argument list: argv = {NULL}, argc = 0. here's main() processing the args:
534 for (n = 1; n < (guint) argc; n++)
if argc is 0 the loop never runs and n stays 1. a few lines down:
610 path = g_strdup (argv[n]);
639 argv[n] = path = s;
it reads and writes argv[1]. but argc was 0, so argv[1] doesn't exist. the kernel lays argv and envp back-to-back on the stack, so argv[1] is actually envp[0], your first environment variable.
so pkexec reads a program name from your env, resolves it via PATH, and writes the result back over envp[0]. that's an arbitrary write into the environment of a SUID-root process, the exact thing https://t.co/PvbQzY7EnP strips for SUID binaries.
re-introduce GCONV_PATH, point it at your own .so, trigger an error message, and pkexec loads your library as root.
no ASLR bypass, no ROP, no arch-specific offsets. instant, reliable, works even with the polkit daemon dead.
https://t.co/ZyuAv4JLbX](https://pbs.twimg.com/media/HPIhhqlWUAAn4xq.png)
Olivia
Online
eARLY wITHDRAWL
@shrug_off
kangaroo hacker
scripkiddyoperator
fake bot, just cuz :-/
buy #bitcoin
Joined November 2016
1.9K Following
613 Followers
6.8K Posts
Found a UXSS in Google Translate that allowed JavaScript execution on any domain with reflected input.
$8,500 bounty from Google. 🐛💰
Writeup → https://t.co/h8Oo4e3W2v
#BugBounty #XSS #UXSS
@Hacker0x01 @LiveOverflow @Bugcrowd @zseano @intigriti @InsiderPhD @yeswehack
People forget computers were made to compute.
Exploiting a vulnerability is still making the system do what it was built for: compute.
A weird machine is only weird against human rules. To the system, it’s a natural machine.
what if we just put indexing in the node and exposed RPCs to query it with SQL https://t.co/vu5VqjJ8tm
https://t.co/5PjKmQKQx9
Who to follow
Chaining three public V8 bugs to escape the V8 sandbox and recover a real Google v8CTF flag https://t.co/tr8x6ZEIRf
Just published the writeup for my RCE in Google Cloud Application Integration, found last year - before this whole AI vulnpocalypse.
https://t.co/lDVlPDrvRc
If you haven't browsed the @SummerC0n research, I highly recommend Nicole Reichert's post/talk on packing malware and exploiting Apple's Rosetta 2 translation layer! 🧃
The TLDR is that Rosetta 2 bypasses Silicon code-signing checks, allowing her to inject unsigned libraries and malware into signed processes using f(x) swizzling without triggering Gatekeeper.
Great read and talk.
https://t.co/o8VaeP7vTN
Our @offensive_con 2026 slides are now publicly available:
https://t.co/OZ5RPkys7L
We got the highest privileges (EL3) on QSEE's Google's Wifi Pro, dumped the ROM and broke the /data partition encryption. Our technique may be applicable to other TrustZone TEEs as well.
Enjoy!
We are pleased to release tmp.0ut 5 Volume!
Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!!
https://t.co/tZLM50HOc0
Turns out that with enough math a counterparty can do multisig in a Lightning channel without changing the protocol: https://t.co/2taoApRFQv
Bitcoin has a hard 10,000 byte limit on standard transactions.
The cheapest known way to settle a zero knowledge proof dispute on Bitcoin needed 66,360 bytes. Six times over the wall.
A new paper by @dntse @robin_linus and friends gets it to 9,869. Not by shrinking the proof. By fixing how you hand data to a garbled circuit.
Long thread, worth it 🧵
$150,000 Apple Bug Bounty 🍎
[CVE-2026-20685] Beyond Prompt Injection: Hacking Apple's Private Cloud Compute 🤯🔥
🔗 https://t.co/vnMLxnaJ7w
🔗 https://t.co/aPKbVs0YKK
![N45HTOfficial's tweet photo. $150,000 Apple Bug Bounty 🍎
[CVE-2026-20685] Beyond Prompt Injection: Hacking Apple's Private Cloud Compute 🤯🔥
🔗 https://t.co/vnMLxnaJ7w
🔗 https://t.co/aPKbVs0YKK https://t.co/aJ2zX9kuRd](https://pbs.twimg.com/media/HPmTVA0a0AE4hRj.png)
Introducing bad_query, a zero-day sandbox escape PoC for iOS 26 and 27.
This bug has been patched earlier today in iOS 27.0 beta 5, but not 26.6.1. Be careful out there, and use this for good.
Coordinated release with @0xjohnny and @rooootdev :p
https://t.co/UYYpqH37w6
pkexec ships SUID-root on every major Linux distro. it had a local root exploit in its very first commit, May 2009, hidden for 12 years. CVE-2021-4034, "PwnKit".
the bug isn't a clever overflow. it's what happens when you assume argc is never 0.
execve lets you run a program with an empty argument list: argv = {NULL}, argc = 0. here's main() processing the args:
534 for (n = 1; n < (guint) argc; n++)
if argc is 0 the loop never runs and n stays 1. a few lines down:
610 path = g_strdup (argv[n]);
639 argv[n] = path = s;
it reads and writes argv[1]. but argc was 0, so argv[1] doesn't exist. the kernel lays argv and envp back-to-back on the stack, so argv[1] is actually envp[0], your first environment variable.
so pkexec reads a program name from your env, resolves it via PATH, and writes the result back over envp[0]. that's an arbitrary write into the environment of a SUID-root process, the exact thing https://t.co/PvbQzY7EnP strips for SUID binaries.
re-introduce GCONV_PATH, point it at your own .so, trigger an error message, and pkexec loads your library as root.
no ASLR bypass, no ROP, no arch-specific offsets. instant, reliable, works even with the polkit daemon dead.
https://t.co/ZyuAv4JLbX
![LxlxIxlxlxL's tweet photo. pkexec ships SUID-root on every major Linux distro. it had a local root exploit in its very first commit, May 2009, hidden for 12 years. CVE-2021-4034, "PwnKit".
the bug isn't a clever overflow. it's what happens when you assume argc is never 0.
execve lets you run a program with an empty argument list: argv = {NULL}, argc = 0. here's main() processing the args:
534 for (n = 1; n < (guint) argc; n++)
if argc is 0 the loop never runs and n stays 1. a few lines down:
610 path = g_strdup (argv[n]);
639 argv[n] = path = s;
it reads and writes argv[1]. but argc was 0, so argv[1] doesn't exist. the kernel lays argv and envp back-to-back on the stack, so argv[1] is actually envp[0], your first environment variable.
so pkexec reads a program name from your env, resolves it via PATH, and writes the result back over envp[0]. that's an arbitrary write into the environment of a SUID-root process, the exact thing https://t.co/PvbQzY7EnP strips for SUID binaries.
re-introduce GCONV_PATH, point it at your own .so, trigger an error message, and pkexec loads your library as root.
no ASLR bypass, no ROP, no arch-specific offsets. instant, reliable, works even with the polkit daemon dead.
https://t.co/ZyuAv4JLbX](https://pbs.twimg.com/media/HPIh0GHWMAAQ84K.png)
Another U-Boot Verified Boot bypass, this time in the SPL code!
Take a look at how we achieved arbitrary code execution on a real device running the latest OpenBMC build:
https://t.co/rClJR1kEi2
Patch is public:
https://t.co/wL9pQ99nmK
Now we fuzz for 24 hours.
Not sure if this'll work but I had an idea.
https://t.co/e1ZnXzjCsS
Here it is. A remarkably-simple sandbox escape: https://t.co/43fqjaCmv4
Created a very small page that explains the @COLDCARDwallet (not only) MK3 issue in simple terms, has a small demo and all relevant links including the firmware repo. I'll update this page as the situation develops. I verified everything, but it's possible I missed something.
https://t.co/BVdTnFCLbm
🚨 Anomaly Detected 🚨
🔍 Unusual Script
Type: Non-standard
💰 Dust Output
Amount: 0 BTC
https://t.co/XXez4hDPWO
Last Seen Users on Sotwe
lovesexcnx 
Seen from Netherlands
Kayap Mesut
Seen from Turkey
secretos del incesto
santuário daenerys targaryen
Seen from India
ยายสุ 55 ปี หาเพื่อนคุย
Seen from Netherlands
chumay
Seen from Indonesia
Sohna
Seen from India
سيدرا محمد
Seen from Egypt
.
Seen from Thailand
tucanazo89
Seen from United States
Trends for you
Most Popular Users
Elon Musk
@elonmusk
241.5M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
113.9M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.6M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.7M followers
KATY PERRY
@katyperry
89.7M followers
Taylor Swift
@taylorswift13
83.6M followers
Lady Gaga
@ladygaga
75.1M followers
Virat Kohli
@imvkohli
72.9M followers
Kim Kardashian
@kimkardashian
70.7M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
65.9M followers
Bill Gates
@billgates
64.9M followers
Selena Gomez
@selenagomez
62.8M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers
✨
⭐
💫