pere retweeted
PoC for CVE-2026-111497 — Brotli BlockSwitch OOB write in Apple's libcompression, reproduced on iOS 27.0.1 via Content-Encoding: br. Fixed in iOS 27.2.1; 27.3 beta 1 still vulnerable. Includes patch diff. github.com/MchinaMd57764/CVE…
pere retweeted
🔓 Breaking the Sandbox: PHP disable_functions Bypass via Use-After-Free (8.5.x / 8.4.x)
Today, ZeroZenX disclosed a Use-After-Free vulnerability in PHP 8.5.x / 8.4.x that allows escaping disable_functions and achieving OS command execution.
Our clients are already protected.
Full technical writeup and PoC on GitHub 👇
github.com/zerozenxlabs/PHP-…
#PHP #AppSec #VulnerabilityResearch #ZeroZenX #bugbounty #zeroday
pere retweeted
If you are the kind of person with the fortitude and creativity to grind on these kinds of bugs for dozens of hours in order to take them from DOS to deterministic RCE, you will fit right in at our company.
careers@IRISC2[.]com
CVE-2026-112611 drops a public PoC: OOB write in CoreGraphics (PDF ShadingType 5).
Array mismatch between /n and /c0 triggers a clean heap overflow inside Apple's native rendering engine.
The timing couldn't be worse for Cupertino:
1. Weaponized entry: an unauthenticated CoreGraphics memory corruption bug, ideal for 0-click chains (iMessage/Safari/Mail).
2. Containment breach: chain it with the newly disclosed "worse_query" sandbox escape to break out and read/modify system and third-party app data.
Twenty years later, parsing complex media and legacy PDF formats in C/C++ remains a gift to exploit brokers.
The walled garden isn't just leaking; the bricks are turning to dust.
github.com/Rust505/CVE-2026-…
pere retweeted
Apple's walled garden sandbox breached again.
Zero-day sandbox escape PoC "worse_query" drops publicly:
- Hits iOS 26.0–26.7.2, 27.2, and unpatched 27.3 beta.
- Successor to bad_query, dropped by forcequitOS and 0xjohnny.
- Escapes container isolation to access system paths, system groups, and modify third-party app data.
The "iOS is inherently secure" pitch relies on strict sandbox boundaries preventing malicious apps from touching other app directories or system state.
Once a local app escapes its container and rewrites another app's data, the zero-trust mobile perimeter is fictional.
Community builds theme toolboxes with it; exploit brokers incorporate it into 0-click surveillance chains.
Patch rollout starts now.
pere retweeted
iPhone 18，iOS 27.0，启用 Apple Intelligence 成功 github.com/jailbreakdotparty…
pere retweeted
One PDF. Preview dies. Your own bytes show up in the fault address.
CVE-2026-112611. CoreGraphics ShadingType 5.
/N says 1 component. Function Range says 136. Buffer sized from /N. Copy overruns.
Fault at 0x3ff000000000001c. That is the PDF's own 1.0 bits plus 0x1c.
Fixed in 27.2.
github.com/Ping-2o/CVE-2026-…
credit: @pwnlambda (find), Ping-2o (repro)
pere retweeted
🚨: A Scientist from Michigan has created Invisible Solar Panels that can convert everyday windows into Electricity Generators.
Readers added context they thought people might want to know
Transparent solar panels for windows build on research by Michigan State University and University of Michigan teams since 2014, with prototypes and one small 2021 MSU installation, but remain unavailable for everyday consumer windows.
snopes.com/fact-check/are…
msutoday.msu.edu/news/2021/08/s…
news.umich.edu/toward-manufac…
pere retweeted
Exploit pdf iOS 27.1 - oob write
github.com/Rust505/CVE-2026-…
pere retweeted
I'm winding down my time in the Apple Security Bounty program — so I'm open-sourcing the research. 100+ PoCs, real CVEs, and the fuzzers that found them. Public repo 👇 github.com/dawgyg/AppleResea…
RT @0xjohnny: New macOS 27.0.1 PoC with AGX firmware R/W via KextRW (by @alfiecg_dev), PAC callback + pointer reuse, and protected GFX PTE…
pere retweeted
You can watch the full breakdown here on YouTube: youtube.com/watch?v=IsQ-Ouox…
pere retweeted
Remember the Heap Buffer Overflow in libheif 1.19.7, which was used by @rootxharsh to hack into OpenAI?
Here is a .heic file from a iPhone photo, which actually contains several images. And the primary image is actually derived from a grid of smaller images. 🧵1/x
