Shunt

22

background image stolen from @YR81_

[Shunt @terawhiz]

Can claude web not use all of the memory?

[[email protected] @Zardus]

Can we translate all C to Rust? The susceptibility of C to memory corruption has long been a cybersecurity pain point, and coding agents can free us of it. Read on for my recent experiments in this space, and apt & docker repos that you can pull rust-converted libraries from!

[hypr @hyprdude]

New post is up! This one uses CVE-2025-20741 (a heap overflow in the MediaTek MT76xx driver) to show how a bit of kernel alchemy can turn a heap OOB write into a number of stronger exploit primitives, up to page-level r/w via pipe_buffer corruption :)
https://t.co/rA7nKZex5U

[Shunt @terawhiz]

claude find a bug in cat

[thaidn @XorNinja]

We asked Claude to find a bug in Vim. It found an RCE. Just open a file, and you’re owned. We joked: fine, we’ll switch to Emacs. Then Claude found an RCE there too.

Full story: https://t.co/7UL9suKs8r

[vx-underground @vxunderground]

> be cow
> cow, but online
> IoT? IoC
> Internet of Cow
> no security
> cows compromised
> cow botnet
> use cows for ddos attacks
> critical infrastructure taken down by cows
> hijack cow sensor
> tell cows to attack at dawn
> open front door
> 1000 cows pooping outside house

[AISafe Labs @aisafe_io]

Can a single prompt secure your application?
The results might surprise you.
👉 https://t.co/w9biRFgOxQ

[ptr-yudai @ptrYudai]

I participated in DiceCTF 2026 Quals and found cornelslop, a kernel exploitation challenge, especially interesting. Here is my writeup🍣
https://t.co/11fA2uyin9

[kqx @kqx_io]

played DiceCTF quals and managed to blood the kernel pwn challenge and won the $150 bounty!

check out the writeup: https://t.co/Jnw80IyrJh

[Calif @calif_io]

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets.

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.

https://t.co/IxURrHpBT0

[Rebane @rebane2001]

i built an entire x86 CPU emulator in CSS (no javascript)

you can write programs in C, compile them to x86 machine code with GCC, and run them inside CSS

[Dmitry Vyukov @dvyukov]

syzkaller/syzbot now has AI agentic framework for kernel bug fix generation, bug assessment, security triage, POC generation, etc:
https://t.co/MO6sET6UkG
Includes set of tools to build kernels, navigate/edit source, test reproducers, etc.
Contributions/research are welcome.

[Disconnect3d @disconnect3d_pl]

Pwndbg 2026.02.18 is out!

We visualize branches in nearpc, sync ur decompiler (IDA/Binja/Ghidra) via decomp2dbg, annotate stack vars from dbgsyms/decomp, added new cmds for tracing kernel allocs/frees, dump task info: https://t.co/Gz2rdZlzxp

Sponsor us: https://t.co/YdAmbhJHyF

[Crackmes.one @CrackmesOne]

Less than a week from the CrackmesOne CTF start -- are you ready? https://t.co/5222yid26L

[Sean Heelan @seanhn]

Blog post: On the Coming Industrialisation of Exploit Generation with LLMs https://t.co/aK4pysY1wD

TL;DR: I ran an experiment with GPT-5.2 and Opus 4.5 based agents to generate exploits for a zeroday QuickJS bug. They're pretty good at it.

Code: https://t.co/47xHRObhRy

[Seth Jenkins @__sethJenkins]

My and @natashenka 's blog post series of an exploit chain for the Pixel 9 is now live! We used 2 bugs to go from a phone number to root :)
https://t.co/GZGVBQ5Cbi

[nasm @nasm_re]

https://t.co/0bJkdUJwX9

[Faith 🇧🇩🇦🇺 @farazsth98]

And finally, part 3 of my blog post series on CVE-2025-38352 – Uncovering Chronomaly

https://t.co/eAMX3aFXz4

[Faith 🇧🇩🇦🇺 @farazsth98]

Finally, here is the blog post containing all the details about how I wrote this PoC: https://t.co/P555NpBaZO

The ~4-5 millisecond race window was more than enough to trigger the vulnerability, but is it enough for a full exploit? Or do I need to extend it? We'll see 😉

[kylebot @ky1ebot]

The one last dance of my phd career is finally published. ropbot (or angrop) can generate ROP chains for x86/x64/arm/aarch64/mips/riscv. The old version of it is already adopted by Google's kernelctf program (and some other orgs ;) ). https://t.co/tL6QvlABP2

[hypr @hyprdude]

We're back, baby! This time with 19+ bugs I reported to MediaTek over the past year + PoCs for each one! I'll also tell you a *fun* story about MediaTek's "creative" impact assessment process. They earned a spot on the naughty list this year :)

Check it ⬇️