Pinned Tweet
Setting up your Pwn2Own target in a capsule hotel and spending the night before the attempt debugging the exploit for fun and profit
Giuseppe Calì retweeted
Boom! I discovered and successfully exploited a vulnerability in the latest version of the Samsung Galaxy S26.
I plan to publish a technical write-up after the security patch is released. :)
Boom! With 3 bug collisions PetoWorks (@petoworks) successfully accessed the Samsung Galaxy S26 remotely, earning them a net $6250 and 2.5 Master of Pwn points #Pwn2Own
Giuseppe Calì retweeted
1day.dev/posts/linux-kernel-…
I was working with some 0-days lately, and one of them was for the pwn2own. Although the registration process did not go as expected, the bug remains particularly interesting from an exploitation perspective. [1/2]
Giuseppe Calì retweeted
🛠️ [POC2026] TRAINING
Vulnerability Research and Exploitation on Edge Devices: Memory Corruption Edition
by Marco Ortisi(@segfault)
📅 Nov 9-11 (3 days)
📍 The Westin Seoul Parnas, Korea
Detail 👉 powerofcommunity.net/#traini…
#POC2026
Giuseppe Calì retweeted
Our first technical blog post is live! Check it out now:
peto.works/techblog/eng-expl…
Giuseppe Calì retweeted
Excited to share this! Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox. This blog post describes the exploitation process of a use-after-free vulnerability in the SVGA subsystem to achieve code execution on the Linux host machine. Enjoy!
blog.exodusintel.com/2026/06…
Giuseppe Calì retweeted
If you want to see how one incorrectly placed exclamation mark in the Linux kernel's nftables subsystem can lead to a local privilege escalation, have a look at my blog post. It covers a technical analysis of the bug I found and how it can be exploited
blog.exodusintel.com/2026/06…
Giuseppe Calì retweeted
I originally prepared this bug for Pwn2Own Berlin. A few days before the contest, a CVE got assigned. So, here is my technical analysis and exploitation strategy for CVE-2026-40369: a 12-byte kernel increment, exploitable both as an LPE and SBX.
voidsec.com/cve-2026-40369-b…
Giuseppe Calì retweeted
i did it again 🙏🙏
Mind blown alert 🤯! Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG (@starlabs_sg) used a Memory Corruption bug to exploit VMware ESXi with the Cross-tenant Code Execution add-on, earning a sweeeeeet $200,000 and 20 Master of Pwn points. Full win let's go! #Pwn2Own #P2OBerlin
Giuseppe Calì retweeted
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Giuseppe Calì retweeted
Bug count != exploitable bug. Finding != chaining.
LLMs are exceptional at pattern recognition on known bug classes. They are not reasoning about novel failure modes in complex multi-component systems.
The hard bugs still require humans. voidsec.com/ai-vulnerability…
Giuseppe Calì retweeted
Pretty sure the vendor reports before the competition starts are likely actively hurting the competitors that have flown out just to have their bounty halved as the issues are now considered 'known'. Equally, you can't just sit on a full chain. Far from the ideal situation...
If you like VPN exploits as much as us, you're going to love this course Zeroshi is bringing to @_ringzer0!
Marco will walk students into opening up edge devices for research, mapping their attack surface, finding vulns and building full exploit chains.
ringzer0.training/countermea…
It was a real pleasure to bring a few vulns to Tokyo and take part in #Pwn2Own Automotive!
Many thanks to ZDI for organising the contest and giving me an excuse to finally visit Japan x)
Earlier this year I spent some time digging into Synology and QNAP NAS devices and reported the following items to ZDI:
ZDI-CAN-28486
ZDI-CAN-28553
ZDI-CAN-28554
ZDI-CAN-28485
I'll post more details on gcali.io as soon as the disclosure process allows it 👋