Sideway

Reverse-Engineering, low level stuff and goats. Pwning stuff @Synacktiv

[Sideway @SidewayRE]

Hell yeah 😎

[TrendAI Zero Day Initiative @thezdi]

Day 2 wraps up with another success! Tanguy Dubroca (@SidewayRE) from Synacktiv (@Synacktiv) used an incorrect pointer scaling leading to privilege escalation on Ubuntu Desktop. They earn $30,000 and 3 Master of Pwn points. #P2OVancouver #Pwn2Own

[Hexacon @hexacon_fr]

🔥 Excited to announce our keynote!

We are thrilled to welcome Bruce Dang (@brucedang) and Thai Duong (@XorNinja) from @calif_io! With all their recent AI buzz, we had to check they aren't just LLMs in a trench coat. 🤖🧥

🎟️ Ticketing opens this Thursday at 2:00 PM CEST ⏰

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[Xint @xint_official]

Patch your Linux boxes!

https://t.co/VWOUDbLAn2 is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.

Found by the teams at @theori_io and @xint_official
More details below
https://t.co/9f6T96PvPX

[V4bel @v4bel]

I discovered a race-based vulnerability class in the Linux kernel: "Out-of-Cancel"

A structural flaw where cancel_work_sync() is used as a barrier for object lifetime management, causing UAF across multiple networking subsystems.

I wrote an exploit for CVE-2026-23239 (espintcp). It interleaves Delayed ACK timers, NET_RX softirqs, timerfd hardirqs, workqueue scheduling, and CFS scheduler manipulation to hit a ~Xµs race window.

Blog: https://t.co/980Iv9t4wE

This is the race scenario diagram 😁:

[Synacktiv @Synacktiv]

Deep dive into the provisionning an on-prem low-privileged #LLM stack, with air-gapped networking and GPU-isolation, hardened down to kernel modules.

What could possibly go wrong?

Read the full article here: https://t.co/OS4clOUn2N

[Synacktiv @Synacktiv]

At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller.
Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit.

🔍 Full technical write-up 👇
https://t.co/R0E5Uqql1E

[TrendAI Zero Day Initiative @thezdi]

The a highlight from Day 2 of #Pwn2Own Automotive, the team from @synacktiv is at it again. This time, they leverage NFC(!) to exploit the #Autel MaxiCharger with a stack-based buffer overflow. Amazing! We've never seen an NFC exploit like this one before.

[Thalium Team @thalium_team]

How was a single heap overflow in an Audible parser enough to compromise an Amazon account? Find out in our latest blog post, in which we break down the Kindle vulnerabilities we reported earlier this year.

https://t.co/v524qgdJca

[Synacktiv @Synacktiv]

A technical look at @GrapheneOS Hardened Malloc, a memory allocator designed to mitigate heap corruption vulnerabilities (UAF, overflows) and break common exploit primitives.
Deep dive for security researchers & exploit developers by @iksocin
https://t.co/99v99YQTdO

[Alexander Popov @a13xp0p0v]

My new article: "Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel"⚡️

I tell a bug collision story and introduce my pet project kernel-hack-drill, which helped me to exploit the hard bug that received @PwnieAwards 2025

https://t.co/0DJzCJYEfm

[Altin (tin-z) @kzalloc1]

Exploit for CVE-2025-27363 on Chrome 113 chrome. This is not a new vulnerability, it was patched in March 2023. This PoC targets only chrome headless mode and i wrote a lot, so i don't know if that it's interesting, the poc is not affected by js sandbox https://t.co/5ntlzkhtZf

[h0mbre @h0mbre_]

Linux kernel: a new feature has landed in this release
Jann Horn:

[Synacktiv @Synacktiv]

The latest Synacktiv Summer Challenge was in 2019, and after 6 years, it's back!
Send us your solution before the end of August, there are skills to learn and prizes to win 🎁
https://t.co/iHwFjcNSk0

[vic @v1csec]

Userland iOS aficionados, I released a simple IDA plugin that should improve your Objective-C experience.

For now it removes ARC function calls in decompiled code (eg objc_retain) and helps listing candidate callers to a method. Check it out at https://t.co/SvvIOWarRb

[TrendAI Zero Day Initiative @thezdi]

Confirmed! Thomas Bouzerar (@MajorTomSec) and Etienne Helluy-Lafont from Synacktiv (@Synacktiv) used a heap-based buffer overflow to exploit #VMware Workstation. They earn $80,000 and 8 Master of Pwn points - sending the contest to over $1,000,000 total! #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

A successful collision! Corentin BAYET (@OnlyTheDuck) from @Reverse_Tactics used 2 bugs to exploit ESXi, but the Use of Uninitialized Variable bug collided with a prior entry. His integer overflow was unique though, so he still earns $112,500 & 11.5 Master of Pwn points. #Pwn2Own

[Synacktiv @Synacktiv]

In iOS 18.4, Apple introduced a bug in dynamic symbol resolutions for some specific exports. @0xf4b took a long journey down a rabbit hole to understand its root cause.
https://t.co/q03QTtw373

[nedwill @NedWilliamson]

Last month @ASU I presented my work on formalizing automated bug discovery, developing a framework to characterize the full spectrum of approaches - from fuzzing to human analysis. I'm sharing my evolving perspective on the fundamental nature of the bug finding problem. Full deck: https://t.co/Tnlr5BTW11

[Eloi Benoist-Vanderbeken @elvanderb]

Better late than never... My Hexacon 2023 slides for "Finding and Exploiting an Old XNU Logic Bug" and the exploit code (WITH THE ANIMATED ASCII ART 🥷🔪🍎!!!) are up https://t.co/Z3ktOkj6Gi / https://t.co/aoUQp3czyp

[itszn @itszn13]

@0x09AL After the first safari -> root chain we landed, I just sat there running it over and over in awe

It’s very difficult to express that feeling, seeing months of complexity compressed down into a single moment….