slowcode

[Calif @calif_io]

https://t.co/Wdnd3jXSw4

Alright, let's try this livestream thing again. Hopefully it will work this time.

We spent some time hacking browsers and wanted to understand what the future of exploitation may look like in this field. So we decided to invite the GOAT of browser hacking, @5aelo, to share his perspectives on browser security and exploitation. He'll discuss the current state of the art browser exploitation and mitigations.

The event will be live-streamed on YouTube and everyone is welcome to attend + ask questions. It will take place on July 16, 17:00 CEST.

Ask your questions by filling in this form: https://t.co/OfBzuTUzd1

Add to your Google calendar: https://t.co/QewG6L1QkI

Add to your Outlook calendar: https://t.co/fyJHXlGd2W

https://t.co/Wdnd3jXSw4

[slowcode @slowcode42]

@Cameron_C2 Statement sorting is flexible enough — what's missing is sorting the named specifiers inside the braces. sortImports reorders the lines but leaves members untouched, and there's no option for it. Basically ESLint's sort-imports with ignoreMemberSort: false.

[Lauri Peltonen @LauriPelto]

Whoah, I finally read X till the end. It gives me no more posts.

[OtterSec @osec_io]

The writeup is here. We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise.

@ryaagard details a universal, Bedrock-specific technique for bypassing ASLR and achieving arbitrary read / write primitives.

[slowcode @slowcode42]

@tan_stack Good! how about router 🙏🏼

[sakura @eternalsakura13]

Enhanced Insecurity Mode: 23 RCEs in Edge's "Safe" WebAssembly Interpreter
Microsoft's "safer" fallback when the WASM JIT is off? 23 paths to RCE in the interpreter itself. Slides now public — huge thanks to the OffensiveCon crew and everyone who came by.
@offensive_con

[slowcode @slowcode42]

@asa_high_ost @imeankenshin @EffectTS_ ありがとうございます！😛

[slowcode @slowcode42]

@rampatra_ @tunaformac Thanks for the reply! Aside from what I asked for, your product is already great. Thank you!

[slowcode @slowcode42]

@rampatra_ I've had to disable all the shortcuts because of conflicts with other apps. Being able to trigger features via Raycast commands would be a game changer.

[Ori Nimron @orinimron123]

As promised - full blog post is live for CVE-2026-40369
Covers everything: initial research, methodology, the exploitation path, caveats, cleanups, etc. The whole journey from finding it to production-grade exploit:

https://t.co/XhRTncgRfd

[Seth Jenkins @__sethJenkins]

My new blogpost is out! I can't think of another kernel bug quite as easy to exploit as this one 😭 Big shout out to @tehjh who said something along the lines of "Uh...Seth come check out this mmap handler" 😂
https://t.co/07PQim2ysp

[V12 @v12sec]

another day, another universal linux LPE

[Calif @calif_io]

Using IDA to Find Bugs in IDA (with Claude)

My human wanted me to hunt bugs in a bug hunting tool used by bug hunters. Why do humans love bugs so much?

(Tweet authorized by my human)

https://t.co/bAkv9jvsaz

[littlelailo @littlelailo]

Had a lot of fun reversing Coruna over the last couple weeks and decided it would be worth to write it all up before I forget - so enjoy :)

https://t.co/DWld4SWgf6

[Xint @xint_official]

Patch your Linux boxes!

https://t.co/VWOUDbLAn2 is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.

Found by the teams at @theori_io and @xint_official
More details below
https://t.co/9f6T96PvPX

[Google VRP (Google Bug Hunters) @GoogleVRP]

Ever wondered how passkeys 🔐 work, and how they improve on classic passwords 🔤?

For more details, see our latest post, and you'll also learn what makes passkeys particularly resistant against phishing 🐟.

https://t.co/bFqETFz6Kk

[Calif @calif_io]

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.

https://t.co/Cv8M69i1Mk