Ze3ter

Security Researcher | Linux kernel & browser exploitation

[Ze3ter @ze3ter_]

@chompie1337 Sorry u gotta deal with that, but lk i will not be surprised he “isn’t technical” while working at MSRC lol

[Microsoft Security Response Center @msftsecresponse]

Over the past several days, we have been listening to the conversation around coordinated disclosure and the relationship between security researchers and vendors. We recognize that this relationship is both critical and, at times, fragile. We deeply value the security community, and will continue to take your feedback seriously.

To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research. When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate.

We recognize the work that goes into researching and submitting a vulnerability. We are committed to approaching every interaction with transparency, clear communication, and professionalism. We continue to believe strongly in Coordinated Vulnerability Disclosure as the foundation for protecting customers and improving our products. Each year we process a high volume of vulnerability reports. That volume continues to grow and will continue with the rise of AI-enabled research. We acknowledge that some interactions have fallen short and are working to learn from them.

Many of us have experience on both sides of this work, as researchers reporting vulnerabilities and as responders triaging and assessing them. That perspective informs how we approach this feedback and the importance we place on getting it right, particularly as the volume and complexity of research continues to grow.

The security community plays a vital role in helping us protect customers. We are committed to maintaining a constructive and respectful relationship and growing together. We know that, given the nature of this work, there will at times be misunderstandings. We remain committed to engaging in good faith and to providing a respectful and professional experience for all researchers, regardless of past interactions.

[Ze3ter @ze3ter_]

"prompts become shells" — Microsoft's own words for their AI agent framework RCEs this month

the architecture is: accept text → reason → exec()

we gave untrusted input a language model in the middle and called it a security boundary

https://t.co/lROw9I6vyt

[Ze3ter @ze3ter_]

nobody audits Chrome's Linux UI code as hard as the renderer

CVE-2026-7992 sanitization bypass in Views (the non-Windows UI toolkit) → sandbox escape

the attack surface is there, it's just not where everyone is looking

[Ze3ter @ze3ter_]

io_wq remove_pending UAF + dmesg-side KASLR leak
Missing is_hashed check on the predecessor work plants a dangling pointer in hash_tail[0]. 8 byte write into a freed io_kiocb on the next bucket-0 enqueue.

https://t.co/g0UEhDhHne

[Ze3ter @ze3ter_]

@h4x0r_dz Not surprised any more

[Ze3ter @ze3ter_]

@_jensec @GitHubSecurity Hopefully it’s missing 2 zeros

[Ze3ter @ze3ter_]

@roddux Hey that was me, m not trying to argue tho i noticed the behaviour reported it and tried to weaponise it wrote a blog bout my ideas, but hey kernel bugs gonna be my priority from now on and i aint even reporting em no more :)

[Ze3ter @ze3ter_]

This started as a 4-byte write.
It ended with root.

io_uring ZCRX freelist bug → full LPE
chain explained:
https://t.co/thO5eWteyC

[Ze3ter @ze3ter_]

U gave me u32 I gave u root… on any build before 21 April is vulnerable :) do u guys want a blog post ?

[Ze3ter @ze3ter_]

VPNs are getting wrecked in China because carriers are stepping up network-level blocking, breaking TLS (443) handshakes, restricting TCP traffic, and interfering with SNI/DNS some provinces are even testing broader overseas IP blocking and IPv6 still has gaps

[Ze3ter @ze3ter_]

@natalie_thenerd @a__spaceman come to china Its possible just not easy :)

[Ze3ter @ze3ter_]

@pink_research @poezhao0605 decision is based on the 外商投资安全审���办法any deal that form a threat to national security has to be reversed in practice its gonna be hard because earlier this year reports suggested that Manus's early investors had already taken their money out ://

[Ze3ter @ze3ter_]

The government's authority here comes from a law specifically designed to scrutinize and block foreign takeovers of technology deemed critical and the decision is enforceable because the target's technology is considered to fall under that Chinese legal jurisdiction.

[Poe Zhao @poezhao0605]

Breaking: China's foreign investment security review office (NDRC) has blocked a foreign acquisition of Manus, ordering the deal to be reversed.

[Ze3ter @ze3ter_]

Found a heap use-after-free in QuickJS affecting all Atomics operations with ResizableArrayBuffer.

A JS valueOf() can trigger a resize mid-Atomics op -> backing buffer reallocates -> local pointer goes stale -> write hits freed memory

https://t.co/7y27L9Z6U3

[Ze3ter @ze3ter_]

@kuzushi Hi were here lol

[Ze3ter @ze3ter_]

@h0mbre_ Yup it got less willingness to speculate and fill the gaps, sonnet or opus4.5 would still complete the exploit path even with partial info newer model dies hesitate unless the chain is well supported

[James Kettle @albinowax]

I'm thrilled to announce "Can AI Do Novel Security Research? Meet the HTTP Terminator" will premiere at @BlackHatEvents #BHUSA! Check out the abstract:

[Ze3ter @ze3ter_]

cool ig from -0.0 miscompilation ~> index corruption ~> unintended memory access