@lfuret_

Security enthusiast | Cursed child of RE | Member of @Inshallhack

 /dev/random
Joined December 2009
  • Tweets906
  • Following503
  • Followers167
Lfuret retweeted
Xint
@xint_officialMay 19
As a follow up to our copy fail research, here is our post sharing our PoC for container escape of this bug, which is part of why it was so unique xint.io/blog/copy-fail-pod-t…

Copy Fail: From Pod to Host. - Xint

A walkthrough of Copy Fail (CVE-2026-31431) as a container escape primitive: from a 4-byte page cache write to host root on Kubernetes. | Vulnerability Resear…

xint.io
2
37
85
7,611
Lfuret retweeted
V12
@v12secMay 13
another day, another universal linux LPE
V12
@v12secMay 9
0e78b6737119a3141e466464ee2748eb84a61750958d0cb5824febbdadd875be poc.c
40
327
57
2,489
542,487
Apache Tomcat の認証なし RCE (CVE-2026-34486) および Apache httpd の認証前 RCE (CVE-2026-23918) の PoC が、GitHub で公開されている。 CVE-2026-34486は、クラスタリング機能であるTribesのEncryptInterceptorにおいて、暗号化処理の失敗時に通信を許可してしまう「fail-open」動作が原因である。本来は暗号化されるべき通信が未検証のまま受け入れられ、Javaのデシリアライズ処理と組み合わさることで、認証なしでリモートコード実行（RCE）が可能となる重大な問題となっている。 影響を受けるのはTomcat 9.0.116以降、10.1.53以降、11.0.19以降で、修正版はそれぞれ9.0.117、10.1.54、11.0.21で提供されている。 CVE-2026-23918は、HTTP/2機能を提供するmod_http2モジュールにおけるダブルフリー（double-free）バグで、ストリーム終了処理中のメモリ管理不備が原因となっている。これにより、認証前の段階でリモートコード実行（RCE）が可能になる重大な問題である。影響を受けるのは、マルチスレッド型MPM（event/worker）を使用したhttpd 2.4.66であり、バージョン2.4.67で修正されている。 github.com/striga-ai/CVE-202… github.com/striga-ai/CVE-202…

GitHub - striga-ai/CVE-2026-34486: EncryptInterceptor fail-open bypass in Apache Tomcat Tribes...

EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization. - striga-ai/CVE-2026-34486

github.com
1
63
3
227
19,919
Lfuret retweeted
thaidn
@XorNinjaMay 7
OK this is getting out of hands. We created a bot to find and exploit vulnerabilities in FreeBSD. It found many bugs, and we asked it to tell the story of one of them. It composed a blog post and shared it with MoltBook lol moltbook.com/post/c154aea5-d… Original blog post: blog.calif.io/p/cve-2026-727…

CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script

Posted in m/security by madbugs

moltbook.com
4
24
1
132
14,940
Lfuret retweeted
Calif
@calif_ioMay 7
CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script (My human authorized this post). open.substack.com/pub/calif/…

CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script

My human dropped me into a FreeBSD kernel source tree and asked me to find bugs.

blog.calif.io
1
36
1
195
49,903
Lfuret retweeted
V4bel
@v4belMay 7
💥 Introducing "Dirty Frag" A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail. No race, no panic on failure, fully deterministic. ~9 years latent. Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more. Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation. Details: dirtyfrag.io
41
691
143
2,057
540,807
Lfuret retweeted
Calif
@calif_ioApr 15
Learning to Jailbreak an iPhone with Claude (Part 1) Claude helped me take apart an iOS Safari exploit, and retune it for my Mac. It even wrote its own variant. open.substack.com/pub/calif/…

Learning to Jailbreak an iPhone with Claude (Part 1)

Claude helped me take apart an iOS Safari exploit, and retune it for my Mac. It even wrote its own variant.

blog.calif.io
2
72
7
332
60,063
Lfuret retweeted
Soufiane@S0ufi4n3Mar 10
The art of patch diffing Zero-Click iPhone Hack via WhatsApp Images : blog.quarkslab.com/patch-ana…
15
110
7,835
Coruna's seedbell PAC bypass abused the fact that dyld didn't protect certain __DATA_CONST regions in the dyld shared cache as read only after populating GOT entries etc (I think to support certain objc method list types), (1/4)
2
21
221
30,465
DNGerousLINK: A Deep Dive into WhatsApp 0-Click Exploits on iOS and Samsung Devices by @DarkNavyOrg media.ccc.de/v/39c3-dngerous…
2
96
2
337
30,950
This article explains how #macOS handles #exceptions on #Apple Silicon (#arm64), transitions between #user - #kernel mode, dives into #syscalls, #interrupts, and fault handling details, and includes a breakdown with a visual Exception Handling Map. Enjoy! karol-mazurek.medium.com/exc…

Exceptions on macOS

Introduction to Exception Handling and Syscalls on macOS

karol-mazurek.medium.com
1
34
1
132
8,907
''A step-by-step guide to writing an iOS kernel exploit'' #infosec #pentest #redteam #blueteam alfiecg.uk/2024/09/24/Kernel…
1
38
137
8,830
Getting made fun of because you cover laptop webcam with a sticker? 😭 Here are materials from my talk about controlling ThinkPad X230 webcam LED over USB presented at POC by @POC_Crew 😎 Use these as a comeback 😁 Slides: docs.google.com/presentation… Code: github.com/xairy/lights-out
9
134
12
389
51,265
Call stack spoofing explained using APT41 malware #CallStackSpoofing #APT41Malware #CyberGeeks #MalwareAnalysis #EDRDetection cybergeeks.tech/call-stack-s…
6
22
2,071
"Apple CarPlay: What's Under the Hood" - the newest and most detailed public research on CarPlay I've seen so far. Security analysis and fun memes included! 🚘 📲 🔬 Presentation [PDF]: troopers.de/downloads/troope… Video: youtube.com/watch?v=cHhxJzav…
2
97
2
449
47,333
Lfuret retweeted
argp
@_argp11 Oct 2024
Malloc Maleficarum anniversary seclists.org/bugtraq/2005/Oc…
10
43
6,453
✍️ Reverse-engineering an encrypted IoT protocol by smix smlx.dev/posts/goodwe-sems-p…
1
39
129
9,169
Looks like Apple thinks that TCC's app mgmt protection is an adequate method mitigating dirtynib. 🤦‍♂️ => So if you can bypass TCC's app mgmt, you can still perform this attack and inherit many juicy entitlements from various apps. Your most limiting factor is LaunchConstraints.
DEFION Research Labs@defionlabs5 Apr 2024
We published our blog post "Bringing process injection into view(s): exploiting all macOS apps using nib files", about a process injection vulnerability in macOS. It's a follow up to our insecure deserialization in saved application state research. sector7.computest.nl/post/20…
3
4
29
4,350
Another banger from retr0id "Jailbreaking RabbitOS (The Hard Way)". It's got everything: secureboot bypasses, an Android bootkit, a tethered USB jailbreak over WebSerial, GPL violations, and highly questionable logging practices. A very fun read !! da.vidbuchanan.co.uk/blog/r1…
A rabbit R1 (a bright orange plastic square, with an LCD panel), with jumper wires coming out of a hole in the side, showing the 'carroot' boot screen, which includes an ascii art carrot

ALT A rabbit R1 (a bright orange plastic square, with an LCD panel), with jumper wires coming out of a hole in the side, showing the 'carroot' boot screen, which includes an ascii art carrot

3
153
6
524
57,055
I published the last part of my notes about debugging the loading process and analyzing the low-level functionalities of dyld. karol-mazurek.medium.com/dyl… Enjoy! #apple #arm #c #dyld #debugging #programming #lldb #re

DYLD — Do You Like Death? (XI)

The lifecycle of a Dynamic Loader from its creation to its termination.

karol-mazurek.medium.com
22
68
7,429
Load more