slowcode retweeted
I gave a talk on Copy Fail at Off-by-One Conference 2026 last week, sharing how I approached the bug starting from 1-day analysis, discovered and exploited its variants, eventually found Copy Fail, and my chain of thought throughout the research.
It was a great experience!
🔥 We’re upping the bar!
@5unkn0wn of Team @theori_io starting the last league on Day 1 of #𝐎𝐁𝟏𝟐𝟎𝟐𝟔 with “From 1-Day Vulnerability Analysis to Copy Fail: Combining AI with Human Insight.”
Brilliant research, fresh perspectives and one seriously good session!
slowcode retweeted
Today we published WeWorm, our zero-click worm that spreads across iOS and Android.
All it takes is one phone call. You don't have to answer. Seconds later, your WeChat account is compromised, calling your friends and spreading the attack.
We reported the bug to Tencent, and it's now mitigated for all users.
We hope this sets an example. The US and China disagree on plenty, but keeping billions of people safe online shouldn't be one of them.
AI gives us a chance to find and fix these bugs faster than ever. We should work together to make the world safer for everyone.
Our story and demos: calif.io/research/weworm
slowcode retweeted
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more!
projectzero.google/2026/09/m…
slowcode retweeted
We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times.
In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…
slowcode retweeted
We have conducted a thorough investigation into the Hugging Face incident.
We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.
openai.com/index/hugging-fac…
slowcode retweeted
Please remember that the overwhelming majority of people that you hear talk online about the current state of programming are not building anything that:
- is dealing with significant amounts of money
- has non-trivial financial risks from production defects
- is being collaborated on by even a single other person
- has been and is being iterated on over a long time scale
also remember that the overwhelming majority of takes online are:
- not coming from a place of actually wanting to provide you with useful information
- are at least in some capacity posturing. This industry is changing at a rapid pace and seeming ahead is of legitimate financial importance to individuals
- bad
slowcode retweeted
youtube.com/live/yk1G5uL3cBo…
Alright, let's try this livestream thing again. Hopefully it will work this time.
We spent some time hacking browsers and wanted to understand what the future of exploitation may look like in this field. So we decided to invite the GOAT of browser hacking, @5aelo, to share his perspectives on browser security and exploitation. He'll discuss the current state of the art browser exploitation and mitigations.
The event will be live-streamed on YouTube and everyone is welcome to attend + ask questions. It will take place on July 16, 17:00 CEST.
Ask your questions by filling in this form: forms.gle/5gDKBibS6WkDx3ck9
Add to your Google calendar: calendar.google.com/calendar…
Add to your Outlook calendar: outlook.live.com/calendar/0/…
youtube.com/live/yk1G5uL3cBo…
Statement sorting is flexible enough — what's missing is sorting the named specifiers inside the braces. sortImports reorders the lines but leaves members untouched, and there's no option for it. Basically ESLint's sort-imports with ignoreMemberSort: false.
slowcode retweeted
Enhanced Insecurity Mode: 23 RCEs in Edge's "Safe" WebAssembly Interpreter
Microsoft's "safer" fallback when the WASM JIT is off? 23 paths to RCE in the interpreter itself. Slides now public — huge thanks to the OffensiveCon crew and everyone who came by.
@offensive_con
I've had to disable all the shortcuts because of conflicts with other apps. Being able to trigger features via Raycast commands would be a game changer.
slowcode retweeted
As promised - full blog post is live for CVE-2026-40369
Covers everything: initial research, methodology, the exploitation path, caveats, cleanups, etc. The whole journey from finding it to production-grade exploit:
pwn2nimron.com/blog
4/4:
Last but not least CVE-2026-40369 - Windows Kernel Arbitrary Increment primitive reachable from any browser sandbox renderer process
This one was rejected from Pwn2Own and closed anyway yesterday :(
My exploit is here - blogpost will be soon:
github.com/orinimron123/CVE-…
slowcode retweeted
My new blogpost is out! I can't think of another kernel bug quite as easy to exploit as this one 😭 Big shout out to @tehjh who said something along the lines of "Uh...Seth come check out this mmap handler" 😂
projectzero.google/2026/05/p…
