Pinned Tweet
After Foxit, It was fun pwning Adobe Reader! Learned quite a lot of things. New achievement unlocked.
I and @shsirk submitted our Adobe Acrobat Reader DC UaF RCE exploit to @thezdi. This was an interesting bug to exploit as we faced quite a few challenges. Stay tuned for the blog post describing how we successfully achieve RCE.
youtube.com/watch?v=cguBkC0o…
Krishs retweeted
We’re publishing a full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12.
👉 Start part 1: eshard.com/blog/kernel-uaf-1…
Krishs retweeted
AI in Offensive Security: Discovery, Validation, and Autonomy teapaw.org/i/broadcasts/1nxnRBPOE…
Krishs retweeted
Video of my @UnpromptedAU & Bsides Canberra talks out now
I built an autonomous N-Day exploit pipeline for the Windows kernel w/ mix of deterministic and AI-led stages. Results were comparable to what Anthropic achieved with Mythos using a much less powerful model.
Now online from BSides Canberra 2026: @chompie1337 presents “Building an Autonomous N-day Exploit Generation Pipeline”.
Watch now: youtu.be/03Xh_6_6U4M
Krishs retweeted
Slides for my talk at @TheSAScon
"Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device"
a13xp0p0v.tech/img/Alexander…
Krishs retweeted
Kernel UaF to Root, part 3:
Turning the address we leaked in part 2 into a kernel write, on a Pixel 6 running Android 12.
🔗Read: eshard.com/blog/kernel-uaf-t…
Krishs retweeted
Google awarded $113,337 USD for a Linux vulnerability discovered by Indonesian security researcher Muhammad Alifa Ramdhan (@n0psledbyte), who works as a Principal Vulnerability Researcher at @starlabs_sg. 🤯
Ramdhan discovered a Linux Local Privilege Escalation (LPE) vulnerability involving a race condition in AF_ALG, the same subsystem later exploited in the famous Copy Fail vulnerability in 2026. He found the issue in 2025 without AI assistance and it was assigned CVE-2025-39964.
His coworker, Bing-Jhong Billy Jheng, was also credited for completing the exploit chain, which enabled both privilege escalation to root and escape from a Docker container. They submitted the exploit to Google kernelCTF and received its highest reward. 💰
Ramdhan is from Tangerang, Indonesia. He graduated from Diponegoro University (@undip) in 2023 and later moved to Singapore to work full time as a vulnerability researcher. 🇮🇩 🇸🇬
idnsec.com/research/linux-lo…
Our own Mr. Q had his Chrome hack featured in the latest Phrack.
Since July and toward the end of the year, we are sharing our latest research at the following conferences: Black Hat USA, Unprompted.au, Blue Hat, Off By One, BSides Canberra, Hexacon, Objective By The Sea, and OffensiveCon.jp.
It's hard to believe we only launched this research program in March. It shows how much can be accomplished with AI and the right people working together.
We'll be sharing more fun results in the coming weeks. Stay tuned!
I used /goal + ASC + adb to analyze my phone. The agent pulled 50+ APKs with uid=1000, then used ASC to analyze them without exporting any pseudocode. After 10 hours, the agent had rooted my phone...😐
#mobile #bugbounty #security
github.com/MG1937/ASC
teapaw.org/MGAldys4/status/209854…
Guys, I built a super fast Android decompiler called ASC.
It completely replaced Jadx MCP for me and lets me analyze 10+ APKs in parallel.
And this week my Agent use ASC found 2 RCE in Honor and Xiaomi!
This tool now accepted by BlackHat EU Arsenal
github.com/MG1937
#BHEU
0-click exploit chain targeting Pixel 9, from RCE in mediacodec to kernel LPE (@natashenka and @__sethJenkins)
Part 1: projectzero.google/2026/01/p…
Part 2: projectzero.google/2026/01/p…
Part 3: projectzero.google/2026/01/p…
#infosec
Krishs retweeted
Sharing my for keynote talk for Offbyone security conference #OB12026 : <A year of hacking with LLMs>
sites.google.com/site/zhinia…
Today we published WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android.
We call you on WeChat and, without you answering or doing anything, take over your account within seconds. Then we use your phone to call your friends.
Story and demos: calif.io/research/weworm
(CVE-2026-87491)[543557673][wasm][sandbox]OOBW, exploited ITW
chromium.googlesource.com/v8…
PoC:
chromium.googlesource.com/v8…
Reported by Jihyeon Jeong:
chromereleases.googleblog.co…
Chained with CVE-2026-85046(type confusion -> arb r/w) & exploited itw, reported by Salvatore Gulizia (Serotav)
chromereleases.googleblog.co…
Fixed here:
chromium.googlesource.com/v8…
PoC:
chromium.googlesource.com/v8…
Writeup with exploitation:
serotav.github.io/Writeups/v…
CVE-2026-85046 is fun to read about
its type v8 confusion turns into
addrof ⇢ fakeobj ⇢ arbitary read/write
all from a browser page
Exploit Notes:
github.com/atiilla/CVE-2026-…
Krishs retweeted
github.com/wh1te4ever/xnu_1d…
I'm finally sharing my xnu_1day_practice project.
It documents I've studied on my own over the past year ..
Feel free to check it out if interested in researching XNU kernel vulnerability.
Krishs retweeted
Chaining three public V8 bugs to escape the V8 sandbox and recover a real Google v8CTF flag blog.himanshuanand.com/2026/…
Krishs retweeted
Exploitation steps and a reliable exploit for Google Chrome ITW V8 TryFastAddDataProperty vulnerability (CVE-2026-11645 [506689381]):
issues.chromium.org/issues/5…
Root cause of Google Chrome V8 ITW (CVE-2026-11645)[506689381]:
TryFastAddDataProperty[1] needs a fast MAP[5]. But "after" checking[2], Map::PrepareForDataProperty[3] manages to normalize the map. The patch[4] rechecks for slow dictionary MAP afterwards.
chromium-review.googlesource…








































