VCSLab

This is the Twitter channel of VCSLab - the research team of Viettel Cyber Security

[TrendAI Zero Day Initiative @thezdi]

And the results are in! Nguyen Thanh Dat (@rewhiles), dungnm (@dungnm_) of Viettel Cyber Security (@vcslab) targeting Sonos Era 300 with 1 collision & 2 zero-days for a total of $10.5K and 4.25 Master of Pwn points #Pwn2Own

[VCSLab @vcslab]

@rewhiles congrats bro, collision again but still amazing!

[TrendAI Zero Day Initiative @thezdi]

We have a collision! Nguyen Thanh Dat (@rewhiles) of Viettel Cyber Security (@vcslab) used 4 bugs to exploit the #Samsung Galaxy S26, but 3 were known by the vendor. They still earn 31,250 and 3.25 Master of Pwn points. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

Boom! Nguyen Thanh Dat (@rewhiles) of Viettel Cyber Security (@vcslab) kicks things off by successfully exploiting the #Samsung Galaxy S26. He's off to the disclosure room to provide the details. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

That's a wrap on Pwn2Own Berlin 2026! 🏆 $1,298,250 awarded. 47 unique 0-days. 3 days of absolute chaos. And talk about main character energy - congrats to DEVCORE for claiming Master of Pwn with 50.5 points and $505,000 - they never slowed down. See you next year! #Pwn2Own #P2OBerlin

[TrendAI Zero Day Initiative @thezdi]

Another collision! Although successful on stage, @rewhiles of Viettel Cyber Security (@vcslab) targeting Anthropic Claude Code in the Coding Agent category used a bug that was previously known to the vendor. They still earn $20,000 and 2 Master of Pwn points. #Pwn2Own #P2OBerlin

[TrendAI Zero Day Initiative @thezdi]

Locked in! Le Duc Anh Vu (@vulda17) of Viettel Cyber Security (@vcslab) exploited Cursor, earning $30,000 and 3 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[TrendAI Zero Day Initiative @thezdi]

Confirmed! Le Tran Hai Tung (@tacbliw), dungnm (@dungnm_) and hieuvd (@gr4ss341) of Viettel Cyber Security (@vcslab) used an integer overflow to escalate privileges on #Windows 11. Their 5th round win nets them $7,500 and 3 Master of Pwn points. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

Confirmed! @vcslab targeted the Sony XAV‑9500ES, exploiting a heap‑based buffer overflow to achieve arbitrary code execution, earning $10,000 USD and 2 Master of Pwn points. #Pwn2Own #P2OAuto

[TrendAI Zero Day Initiative @thezdi]

Collision! @rewhiles of @vcslab targeted the Kenwood DNR1007XR, demonstrating one bug but encountering a collision, earning $2,500 USD and 1 Master of Pwn point. #Pwn2Own #P2OAuto

[TrendAI Zero Day Initiative @thezdi]

Collision! @rewhiles of @vcslab targeted the Alpine iLX-F511, hitting a one-vulnerability collision with a previous attempt and earning $2,500 USD and 1 Master of Pwn point. #Pwn2Own #P2OAuto

[VCSLab @vcslab]

2025 has seen many great web security findings.
Honored that @_l0gg's SharePoint ToolShell pre-auth RCE (CVE-2025-53770) is nominated for @PortSwigger Top 10 Web Hacking Techniques 2025.
If you're in the community, your vote would mean a lot: https://t.co/amYMLrKrOv
Thanks!

[TrendAI Zero Day Initiative @thezdi]

We have another collision. Team Viettel used two bugs to exploit the Lexmark CX532adwe. While their heap based buffer over was unique, the other bug has been seen earlier in the contest. They still earn $7,500 and 1.5 Master of Pwn points. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

Confirmed! namnp of Viettel Cyber Security used a crypto bypass and a heap overflow to exploit the Phillips Hue Bridge. They earn $20,000 and 4 Master of Pwn points, which catapults them in the Top 5. It also puts us over $1,000,000 for the contest! #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

Another confirmation! Dinh Ho Anh Khoa (@_l0gg) and Phan Vinh Khang (@pivik_) of Viettel Cyber Security used a unique command injection and two bugs that collided with previous bugs to exploit the Home Automation Green. They earn $12,500 and 2.75 Master of Pwn points. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

🏠Boom! @ViettelCyberSec kicks off Day 2 of #Pwn2Own Ireland as they slip past the @home_assistant Green’s defenses! Smart home, smarter hack. They head off for the first disclosure of the day. #P2OIreland

[Viettel Cyber Security @ViettelCyberSec]

Our researcher Khoa Dinh just published his findings for ToolShell
Check it here

[Viettel Cyber Security @ViettelCyberSec]

🚨 VCS warns of active attacks on a critical SharePoint vuln we first discovered & reported.
Hackers can bypass auth & take over on-prem servers.
📌 Read our guidance: prevention, detection, hunting & more.
https://t.co/nbzLcN0rWp

[VCSLab @vcslab]

🌟 Huge shoutout to our brilliant researcher @_l0gg for discovering the critical SharePoint vulnerability at Pwn2Own Berlin!
🔍 His in-depth analysis of the widely exploited ToolShell flaw is a must-read for the cybersecurity community.

[Khoa Dinh @_l0gg]

Blog for ToolShell
Disclaimer: The content of this blog is provided for educational and informational purposes only.
https://t.co/gT0aoKXkig
#SharePoint #ToolShell

[VCSLab @vcslab]

🚨 Shocking impact from the SharePoint vulnerability we found at Pwn2Own! 😱
Despite our efforts to patch it 🤝, many systems are still at risk ⚠️. Secure yours now! 🔒 Details: https://t.co/cE41Vt5EPi

[Khoa Dinh @_l0gg]

Viettel Cyber Security Press Release for Customer alert, Latest research and Recommendations.
Blog is comming
https://t.co/JY6zGnTg6T
#SharePoint #ToolShell