b0ring retweeted
Chinese LLMs can hack better than state-sponsored hackers with properly evolved harness -
Kimi K2.5 managed to find and exploit 6 vulnerabilities in browsers: a single page view or an extension install by victims equal full system hijack.
Check arxiv.org/abs/2604.20801
Is this written by AI?
#GlassCage zero-click attack IOS
Once triggered, the chain escalates to full root access via a combination of WebKit RCE (CVE-2025-24201) and Core Media kernel exploitation (CVE-2025-24085).#IOCs
weareapartyof1.substack.com/…
Thanks, @msftsecresponse ! Thrilled to be on the leaderboard with everyone! 😊
Shoutout to the other incredible researchers who made this quarter’s leaderboard. Your work and partnership is deeply appreciated! @dhiralpatel94 @dnpushme @HaifeiLi @sim0nsecurity @KeyZ3r0 @xtytia0922 @longgregc @hpy_insu @nevul37 @nvk0x @ashketchum_16 @niraj1mahajan @fatnass1f1ras @thisis0xczar @martin_jw @AnupamAs01 @scwuaptx @_dirkjan @ImanGurung13 @guilhermesgi
b0ring retweeted
TF is too mature for bug hunting, so we introduced a new surface for u guys.
V8 is leaving the Sea-of-Nodes Turbofan compiler for the shores of CFG, read all about it in my colleague's blog post: v8.dev/blog/leaving-the-sea-…
Let’s compete again next year
📯 Announcing the top 20 Chrome VRP researchers for 2024: crbug.com/386306231 📯
Congratulations to everyone on the list! Many thanks and much gratitude to our entire Chrome VRP researcher community and helping us make Chrome Browser & Chromium more secure for all users! 🎊
😇😇
Sophos Used Custom Implants to Surveil Chinese Hackers Targeting Firewall Zero-Days securityweek.com/sophos-used…
b0ring retweeted
virustotal.com/gui/file/9f18… "Desktop Window Manager local privilege escalation.docx"
We discovered a new zero-day in Microsoft Windows used in attacks with QakBot and other malware. It was just fixed as CVE-2024-30051, and this time it all started with a curious find on VirusTotal… @r00tten securelist.com/cve-2024-3005…
🍈🍈🍈🍈🍈🍈
·Severity: Important
·Bounty: None
Is this "mitigation" a new method to reduce vulnerabilities?
@msftsecresponse
b0ring retweeted
That is actually a lot harder than people think. iOS updates or reinstalls or or have the habit to turn these features on again. Blame Apple for these dark patterns to make everyone use it
Incredible work for both😁👍👍
We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it. securelist.com/operation-tri…
Very happy to be #0. My favorite aspect of Chrome VRP is its vulnerability disclosure policy, which makes the process transparent and allows everyone to learn new things from each other. I suggest that Apple and MSRC should learn from it.🥳
📯 Announcing the top Chrome VRP researchers for 2023: crbug.com/1509898 📯
Congratulations to everyone on the list! 🥳
Many thanks and much gratitude to our entire Chrome VRP researcher community and helping us make Chrome Browser & Chromium more secure for all users!
ALT Chrome VRP 2023 top researcher leaderboard
👏
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
👏
Exploiting the libwebp Vulnerability in Chrome by DARKNAVY.
blog.darknavy.com/blog/explo…
blog.darknavy.com/blog/explo…
b0ring retweeted
A technical breakdown of #iOSTriangulation securelist.com/operation-tri… via @kucher1n @bzvr_ @2igosha @oct0xor & Valentin Pashkov #TheSAS2023
b0ring retweeted
We've talked about #iOSTriangulation's stealth previously, however in our latest article, we look in detail at TriangleDB - the main implant.
The level of stealth included using validators to ensure the exploits weren't delivered to security researchers.
securelist.com/triangulation…
