@_L4ys

Co-Founder of @TrapaSecurity and @PwnableTW MSRC Top 100 / ZDI Platinum / Samsung Mobile Security HoF Hunting bugs for fun

 台灣
blog.l4ys.tw
Joined January 2015
  • Tweets2.6K
  • Following1.2K
  • Followers4.5K
50Media
L4ys retweeted
pwn.ai
@pwn_aiOct 15
Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors. CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:
🤖 Made with AI
16
222
46
1,264
381,577
L4ys retweeted
XBOW
@XbowOct 13
Ask @moyix anything about our Chrome full-chain exploit. 👀 He published the technical breakdown of how he did it (xbow.com/labs/research/zero-…)...but if you have questions or want to go deeper, drop your questions in this thread! He’ll be answering them LIVE on Wednesday, 10/14, from 12–1 PM ET. 💚

Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain

Google awarded this chain the first $250,000 Chrome full-chain reward under the VRP rules introduced in April 2026. This post is about the exploit.

xbow.com
9
32
3
145
20,238
Agenda for OffensiveCon Tokyo 2026 is live! Explore the talks and plan your schedule now: offensivecon.jp/agenda/2026.… #OffensiveCon #Tokyo
21
5
37
8,339
how it feels lately
3
8
93
3,909
miss the old days of playing flare-on seeing familiar ids on the scoreboard felt like seeing old friends. hope everyone's doing well
1
1
62
2,138
L4ys retweeted
DEVCORE@d3vc0r3Sep 1
DEVCORE CONFERENCE 2027 | CFP is open #Redteam, #VulnerabilityDiscovery, #Physicalsecurity, firmware and hardware RE, #AI attack surfaces. Bring the research that starts from a hacker's view. Deadline: Oct 11, 2026, 23:59 GMT+8 sessionize.com/devcoreconfer…
8
1
27
5,418
Sharing my for keynote talk for Offbyone security conference #OB12026 : <A year of hacking with LLMs> sites.google.com/site/zhinia…

A Year of Hacking with LLMs

This blog is a summary of my talk at the Offbyone 2026 cybersecurity conference. It records some of my thoughts as a cybersecurity researcher after spending a year using LLMs for research. Slides:...

sites.google.com
5
141
6
553
42,184
🤦‍♂️ Fix ZDI site with uBlock origin: zerodayinitiative.com##+js(aeld, /^wheel$/, wheelMultiplier, elements, window)
8
858
Faster than a speeding sloth, @dustin_childs breaks down another record-breaking #PatchTuesday release with over 970 CVEs from Microsoft and 172 from Adobe. 3 0-days. Read the details at zerodayinitiative.com/blog/2…

Zero Day Initiative — The September 2026 Security Update Review

Whelp, here we are. Deep into the new normal. With nearly 1,000 CVEs coming out from Microsoft and a healthy release from Adobe as well, there’s a phrase from my military days that comes to mind:...

zerodayinitiative.com
2
7
1
31
6,985
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more! projectzero.google/2026/09/m…

Testing race conditions with memory access tracing and stack-based delay injection

Many security bugs are race conditions, where multi-threaded execution has to occur with the righ...

projectzero.google
4
114
4
448
40,469
L4ys retweeted
Calif
@calif_ioSep 8
Today we published WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. We call you on WeChat and, without you answering or doing anything, take over your account within seconds. Then we use your phone to call your friends. Story and demos: calif.io/research/weworm
10
99
18
389
95,342
L4ys retweeted
Xion@0x10nSep 6
Showing "how many cool 0days we found with our system" is fun, but more importantly, we all should continue iterating and improving on things that didn't work. Enjoy the blogpost! qedaudit.io/blog/brilliantly… (5/5)

qedaudit.io

QED found CVE-2026-19174, an integer overflow vulnerability in V8 that allows arbitrary code execution without a heap sandbox bypass.

qedaudit.io
1
17
77
4,477
I highly recommend submitting to @d3vc0r3 CONFERENCE, which has opened its CFP for the first time! The conference features high-quality offensive and defensive content, offers generous speaker package, and is a wonderful chance to enjoy Taiwan’s amazing food 🍊!
DEVCORE@d3vc0r3Sep 1
DEVCORE CONFERENCE 2027 | CFP is open #Redteam, #VulnerabilityDiscovery, #Physicalsecurity, firmware and hardware RE, #AI attack surfaces. Bring the research that starts from a hacker's view. Deadline: Oct 11, 2026, 23:59 GMT+8 sessionize.com/devcoreconfer…
1
4
30
2,990
@QED_Audit found CVE-2026-19174, an integer overflow in V8 that gives you arbitrary code execution in Chrome. The bug is one line of constant arithmetic. It survived 3.5 years of fuzzing, manual audit, and LLM-driven review. (1/n)
3
14
2
111
26,988
me: checked that Astra was available, then forgot to switch back
8
1,551
A small IDA plugin for quickly toggling argument name hints in 9.4: gist.github.com/L4ys/db41ff2…
2
14
148
9,029
My third @PwnieAwards trophy! Thanks all, and to my friends who grabbed it on stage for me! 🦄🏆
9
37
590
28,027
testbnull.medium.com/hunting… Some note of recent Exchange Server Pre-Auth RCE! Have fun reading!

Hunting Exchange Server 0day like a detective

It has been a while since my last blog post, not because I didn’t do anything (or I?), I just don’t have any time/ any motivation to start…

testbnull.medium.com
6
57
231
21,006
First time actually coming to check out DEFCON
2
48
1,404
Load more