Pinned Tweet
My latest Chrome bug just got derestricted.
Did you know that floats have a minus zero? Turns out if you forget about it, that can mean RCE :).
bugs.chromium.org/p/chromium/iss…
Did you know that floats have a minus zero? Turns out if you forget about it, that can mean RCE :).
bugs.chromium.org/p/chromium/iss…
8
179
612
stephen retweeted
Firefox 159.0 just fixed 41 sechigh vulnerabilities found by me and @ky1ebot
Most of these leads to code exec in the renderer!
Along side a heroic effort from the Mozilla security team to secure Firefox with agents!
One of many projects we are working to harden, more to come
Most of these leads to code exec in the renderer!
Along side a heroic effort from the Mozilla security team to secure Firefox with agents!
One of many projects we are working to harden, more to come
7
22
165
11,600
I was disappointed that nearly nobody at #OffensiveCon remembered Holey Beep from 8 years ago.
A bug in the setuid beep binary beep. You had to win multiple races to write 4 bytes of uninitialized memory to an arbitrary file.
And ofc, the man page boasted that it's unhackable.
A bug in the setuid beep binary beep. You had to win multiple races to write 4 bytes of uninitialized memory to an arbitrary file.
And ofc, the man page boasted that it's unhackable.
1
2
22
1,411
stephen retweeted
After a few years in beta, the V8 Sandbox is now considered a real security boundary! (Just announced at OffensiveCon Tokyo together with @mlippautz). This is less about reaching a particular software milestone than about two things:
5
24
195
12,115
stephen retweeted
100 V8 Exploits: lessons learned from three years of v8CTF by @_tsuro and Carl Smith
1
7
85
4,587
stephen retweeted
Agenda for OffensiveCon Tokyo 2026 is live!
Explore the talks and plan your schedule now:
offensivecon.jp/agenda/2026.ht…
#OffensiveCon #Tokyo
Explore the talks and plan your schedule now:
offensivecon.jp/agenda/2026.ht…
#OffensiveCon #Tokyo
0
22
39
9,748
stephen retweeted
Glad to announce IERAE CTF is back!
AI killed CTF? We believe we're not done yet!
Bring your insight or an agent that proves us wrong 😄
IERAE CTF FINAL for Humans Round 1
- Oct 10, 00:00 UTC
- 1 chal, 8 hours
- $1,000 in prizes
AI killed CTF? We believe we're not done yet!
Bring your insight or an agent that proves us wrong 😄
IERAE CTF FINAL for Humans Round 1
- Oct 10, 00:00 UTC
- 1 chal, 8 hours
- $1,000 in prizes
IERAE CTF 2026 — FINAL for Humans #1
One Web challenge. A vanilla AI agent couldn't solve it in testing. AI is welcome.
October 10 · 09:00 JST
alpacahack.com/ctfs/ierae-fin…
2
6
35
3,827
stephen retweeted
Today I'm joining Anthropic to lead the cybersecurity mission of the Frontier Red Team.
In my career I've never seen a clearer opportunity to build a more secure world for everyone. For 40 years we've lived with fundamentally insecure technology. What will it take to make the past 40 years of hacking a historical oddity? That's what I'm here to find out.
Super excited to work with @logangraham and the rest of the FRT crew.
In my career I've never seen a clearer opportunity to build a more secure world for everyone. For 40 years we've lived with fundamentally insecure technology. What will it take to make the past 40 years of hacking a historical oddity? That's what I'm here to find out.
Super excited to work with @logangraham and the rest of the FRT crew.
111
55
1,414
161,224
stephen retweeted
During my time at @QED_Audit I circled back and took another quick look at browser/JSE vulnerability research. AI agents flying high, seemingly finding & exploiting bugs everywhere, and there's this: a **constant integer overflow** in V8, alive for over 3.5 years. (1/5)
@QED_Audit found CVE-2026-19174, an integer overflow in V8 that gives you arbitrary code execution in Chrome. The bug is one line of constant arithmetic. It survived 3.5 years of fuzzing, manual audit, and LLM-driven review. (1/n)
2
25
148
17,441
stephen retweeted
I found a Linux 0day vuln with @rqda_A, and $80,000+ rewarded for it by Google kernelCTF!
The vuln has been surprisingly hidden for about 19 years.
We've published an English version of the blog post!
gmo-cybersecurity.com/blog/19-years-…
The vuln has been surprisingly hidden for about 19 years.
We've published an English version of the blog post!
gmo-cybersecurity.com/blog/19-years-…
Linux kernelで19年以上見過ごされていた0-day脆弱性を報告しました
悪用されると一般ユーザーからの権限昇格が可能になる脆弱性です
詳しくはこちら
gmo-cybersecurity.com/blog/19-year-o…
8
109
657
56,454
stephen retweeted
We won v8CTF, with Codex!
This is the first confirmed 0day entry in v8CTF since Oct 2025. Our entry was submitted on June 19, at the bottom:
docs.google.com/spreadsheets/d…
Full technical writeup and PoCs will be released after the bugs are fixed.
This is the first confirmed 0day entry in v8CTF since Oct 2025. Our entry was submitted on June 19, at the bottom:
docs.google.com/spreadsheets/d…
Full technical writeup and PoCs will be released after the bugs are fixed.
3
29
299
25,460
stephen retweeted
This Williams story is crazy. The documents only leave more questions. How did L3Harris (company 1) learn about the sales to Operation Zero (company 3)?
Were they able to attribute their own exploit (item 3) by looking at the rop chain or did he legit leave the headers in?
Were they able to attribute their own exploit (item 3) by looking at the rop chain or did he legit leave the headers in?
6
14
49
13,223
stephen retweeted
Here's my Wired story about his guilty plea and what prosecutors revealed in this morning's hearing: wired.com/story/peter-wi…
2
23
84
69,084
stephen retweeted
We derestricted crbug.com/382005099 today which might just be my favorite bug of the last few years: bad interaction between WebAudio changing the CPU's handling of floats and V8 not expecting that. See crbug.com/382005099#comm… for a PoC exploit. Also affected other browsers
4
48
246
22,824
stephen retweeted
"they did not feel their research was ready to publicly demonstrate"
And this kids is what happens when you can't come up with a catchy name for your vuln on time.
If anyone else wants to disclose whatsapp 0click, our team is always available to help: sales@0day.marketing
And this kids is what happens when you can't come up with a catchy name for your vuln on time.
If anyone else wants to disclose whatsapp 0click, our team is always available to help: sales@0day.marketing
2
11
43
20,647
Check out POE2! Hardware support to build untrusted JIT!
More HW security goodness from Arm:
community.arm.com/arm-community-…
vMTE (Virtual Memory Tagging) allows to use MTE in a more flexible way, consuming less RAM.
POE2 allows to build efficient in-process sandboxes and isolation. More-or-less improvement over x86 Memory Protection Keys.
0
3
12
6,785
stephen retweeted
NEW: The U.S. govt accused Peter Williams, ex general manager of hacking tool maker L3Harris Trenchant, of stealing trade secrets and selling them to buyer in Russia.
Earlier this year Trenchant investigated a leak of internal tools. It's unclear if the investigation is related.
Earlier this year Trenchant investigated a leak of internal tools. It's unclear if the investigation is related.
6
58
197
90,240