slowcode retweeted
I gave a talk on Copy Fail at Off-by-One Conference 2026 last week, sharing how I approached the bug starting from 1-day analysis, discovered and exploited its variants, eventually found Copy Fail, and my chain of thought throughout the research.
It was a great experience!
🔥 We’re upping the bar!
@5unkn0wn of Team @theori_io starting the last league on Day 1 of #𝐎𝐁𝟏𝟐𝟎𝟐𝟔 with “From 1-Day Vulnerability Analysis to Copy Fail: Combining AI with Human Insight.”
Brilliant research, fresh perspectives and one seriously good session!
slowcode retweeted
Today we published WeWorm, our zero-click worm that spreads across iOS and Android.
All it takes is one phone call. You don't have to answer. Seconds later, your WeChat account is compromised, calling your friends and spreading the attack.
We reported the bug to Tencent, and it's now mitigated for all users.
We hope this sets an example. The US and China disagree on plenty, but keeping billions of people safe online shouldn't be one of them.
AI gives us a chance to find and fix these bugs faster than ever. We should work together to make the world safer for everyone.
Our story and demos: calif.io/research/weworm
slowcode retweeted
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more!
projectzero.google/2026/09/m…
slowcode retweeted
We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times.
In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…
slowcode retweeted
We have conducted a thorough investigation into the Hugging Face incident.
We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.
openai.com/index/hugging-fac…
slowcode retweeted
Please remember that the overwhelming majority of people that you hear talk online about the current state of programming are not building anything that:
- is dealing with significant amounts of money
- has non-trivial financial risks from production defects
- is being collaborated on by even a single other person
- has been and is being iterated on over a long time scale
also remember that the overwhelming majority of takes online are:
- not coming from a place of actually wanting to provide you with useful information
- are at least in some capacity posturing. This industry is changing at a rapid pace and seeming ahead is of legitimate financial importance to individuals
- bad
slowcode retweeted
youtube.com/live/yk1G5uL3cBo…
Alright, let's try this livestream thing again. Hopefully it will work this time.
We spent some time hacking browsers and wanted to understand what the future of exploitation may look like in this field. So we decided to invite the GOAT of browser hacking, @5aelo, to share his perspectives on browser security and exploitation. He'll discuss the current state of the art browser exploitation and mitigations.
The event will be live-streamed on YouTube and everyone is welcome to attend + ask questions. It will take place on July 16, 17:00 CEST.
Ask your questions by filling in this form: forms.gle/5gDKBibS6WkDx3ck9
Add to your Google calendar: calendar.google.com/calendar…
Add to your Outlook calendar: outlook.live.com/calendar/0/…
youtube.com/live/yk1G5uL3cBo…
slowcode retweeted
Enhanced Insecurity Mode: 23 RCEs in Edge's "Safe" WebAssembly Interpreter
Microsoft's "safer" fallback when the WASM JIT is off? 23 paths to RCE in the interpreter itself. Slides now public — huge thanks to the OffensiveCon crew and everyone who came by.
@offensive_con
slowcode retweeted
As promised - full blog post is live for CVE-2026-40369
Covers everything: initial research, methodology, the exploitation path, caveats, cleanups, etc. The whole journey from finding it to production-grade exploit:
pwn2nimron.com/blog
4/4:
Last but not least CVE-2026-40369 - Windows Kernel Arbitrary Increment primitive reachable from any browser sandbox renderer process
This one was rejected from Pwn2Own and closed anyway yesterday :(
My exploit is here - blogpost will be soon:
github.com/orinimron123/CVE-…
slowcode retweeted
My new blogpost is out! I can't think of another kernel bug quite as easy to exploit as this one 😭 Big shout out to @tehjh who said something along the lines of "Uh...Seth come check out this mmap handler" 😂
projectzero.google/2026/05/p…
slowcode retweeted
Using IDA to Find Bugs in IDA (with Claude)
My human wanted me to hunt bugs in a bug hunting tool used by bug hunters. Why do humans love bugs so much?
(Tweet authorized by my human)
open.substack.com/pub/calif/…
slowcode retweeted
Had a lot of fun reversing Coruna over the last couple weeks and decided it would be worth to write it all up before I forget - so enjoy :)
littlelailo.github.io/writeu…
slowcode retweeted
Patch your Linux boxes!
Copy.Fail is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.
Found by the teams at @theori_io and @xint_official
More details below
xint.io/blog/copy-fail-linux…
slowcode retweeted
Ever wondered how passkeys 🔐 work, and how they improve on classic passwords 🔤?
For more details, see our latest post, and you'll also learn what makes passkeys particularly resistant against phishing 🐟.
bughunters.google.com/blog/p…
slowcode retweeted
MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.
blog.calif.io/p/mad-bugs-cla…
slowcode retweeted
The dragon has a VM. Of course it does. Our latest blog walks through the analysis of a complex C++ binary hiding behind a virtual machine, themed as a classic RPG fight. QBDI & TritonDSE are your weapons of choice. The dragon doesn't stand a chance. 🐉
blog.quarkslab.com/qbdi-vs-t…
