Proxmox VE 7.x authentication bypass (pre-auth RCE)

Fixing carbon buildup in a turbocharged engine might cost you $55,000. Here is how we exploited a flaw we found in Google V8's Turboshaft. We received reports that this vulnerability was exploited against some products. Make sure your Chromium is up to date. Writeup below.

25 elite hacking teams raced in the final kernelCTF. NebuSec closed out the history of the classic kernelCTF with 99% exploit stability, 0.1s exploit time, and 0.000461s submission time. We’ll soon open-source our kernelCTF infra and a walkthrough of how we won every kCTF we entered, and pushed our time cost down to the absolute minimum.

CVE-2023-2156 was believed to be just a remote kernel DoS, patched in 2023. We found a bypass and achieve privilege escalation and container escape. Read the $10,500 story of CVE-2026-43501 "Route of Root": nebusec.ai/research/cve-2026…

Amazing work.

We’ve open-sourced one-click Docker setups and full exploits for Nginx-{PoolSlip, QuicBurst}, both with remote ASLR bypasses. Try them here: github.com/NebuSec/CyberMeow… PoolSlip's OOB write leaks ASLR data extremely fast, while QuicBurst's UAF takes longer.

Here's the final chapter of our IonStack series, the Android rooting part. Including how we use GhostLock (CVE-2026-43499) to defeated KASLR on Android and bypassed KCFI to get arbitrary kernel memory read and write: nebusec.ai/research/ionstack…

We can easily find more vulnerabilities, the reason we didn't do that is simply we don't have enough people to patch them all. During our first scan in Feb, we found 600+ vulnerabilities in Linux kernel and till nowadays 100+ patches were merged and we are still fixing the rest of them...

After the Hugging Face incident, have you wondered how easy it is to escape a modern agent sandbox? We benchmarked eight open-source agent sandboxes to show how vulnerable they can be, and why frontier models can break out so easily.

Watch us open the camera and uncover the anonymous identity behind Tor browser: We published the writeup for the browser RCE in IonStack. Mythos reported 271 bugs in Firefox 150 but still missed this one. And the Tor Browser is also affected by CVE-2026-10702. Update your Tor!

We won kernelCTF again with a new 0-day vulnerability and eligible for another $100k bounty

Try a live IonStack root on your Pixel 10: rootme.nebusec.io In the IonStack demo, we left the rootme URL visible and put up a giant countdown as a tribute to jailbreakme.

GhostLock (CVE-2026-43499) is a 15yr old kernel 0-day we used in IonStack full chain exploit. Everything around you, as long as it runs Linux, from IoT to mobile to desktop, is affected. Read how we won $92,337 bug bounty with GhostLock and see our exploit on Github. Link below

Since V8 had heap sandbox, Chrome renderer RCE usually means chaining 2 bugs Today we bring the Spear of Longinus 1 bug, 100% success, no heap spray, found in 40+ major versions, arbitrary renderer read/write + V8 sandbox escape Our CVE-2026-6307 writeup nebusec.ai/research/v8-cve-2…

"IonStack" is chained with two 0-days: CVE-2026-10702 and CVE-2026-43499. CVE-2026-10702 is a Firefox 0-day. At its core, it was an instruction-modeling flaw buried deep inside IonMonkey, Firefox’s highly complex JIT compiler. Even after Mythos’s extensive audits, the bug was still missed. This is the first publicly disclosed JIT vulnerability since then. We were able to uncover the vulnerability and turn it into a highly stable exploit with a nearly 100% success rate, ultimately achieving remote arbitrary code execution in Firefox. CVE-2026-43499 is a universal Linux kernel LPE vulnerability that has lived in the kernel tree for 15 years since v2.6.38 and affects every distribution: desktop, server, Android, and embedded. It does not require any special kernel modules; CONFIG_FUTEX_PI is all it needs, and to our knowledge, it’s enabled across all distributions we researched. The bug primitive is a UAF in stack caused by a race condition. Turning it into a reliable LPE takes several stack tricks, but eventually it becomes very stable. We measured 10/10 successful privilege escalations on Linux 6.12, along with a high success rate on Android. We will write a series of blog posts disclosing both 0-days used in “IonStack”. The first post is coming soon. Stay tuned.