Security Researcher at @vcslab | CTF player (pwn) of @u0Kplusplus
Hanoi, Vietnam
Joined June 2013
- Tweets467
- Following1.2K
- Followers944
- Likes4.2K
Hai Tung retweeted
The story behind the chrome full chain bonus,
we thought that we could get it using 1-day renderer exploit that I had + 0-day sbx that he found, but we got a reply that all the bugs used in the chain must be 0-days.
As I was working on an exploit of a different target, I couldn't spare any time for his work.
After a few days, I heard that he got a 0-day exploitable v8 bug from nebusec, so I was like "wtf, really?".
So, I joined him in finding v8 heap sandbox bug after finishing my work.
Then we've managed to find a non-duplicate v8 heap sandbox bug after 2,3 days, fuzzing and spending tokens all night.
Huge congrats to him for believing it was possible and putting in the work to make it happen.
We just received a $250,000 Chrome Full Chain bonus! 🎉
We've claimed the second Full Chain bonus of 2026. Only two remain!
Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched.
Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research.
P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!
Hai Tung retweeted
To leverage AI agents for vulnerability research, we built a hybrid source-code analysis workflow that combines deterministic analysis with agentic reasoning. Applied to FreeRDP, it helped us uncover vulnerabilities and chain them into client-side RCE.
blog.quarkslab.com/from-ai-a…
Hai Tung retweeted
$300,000!!!!! and 30 Master of Pwn points officially makes Ikotas Labs, Inc. the Master of Pwn as they jump to the top of the leader board after they chained multiple issues together to successfully exploit the Google Pixel 10 #Pwn2Own
Hai Tung retweeted
Success!! Tim Becker (@tjbecker) and Yves Bieri (@yves_bieri) of Xint (@xint_official) just remotely exploited the targeting Google Pixel 10! Stay tuned for confirmation if they will secure the total of $300,000 and 30 Master of Pwn points!
Hai Tung retweeted
If you're into Windows internals, kernel development or reverse engineering, bookmark this.
@codemachineinc has an incredible FREE archive of low-level Windows research covering:
• WinDbg + kernel debugging
• Windows kernel data structures
• Kernel callbacks
• NTOSKRNL internals
• EX_FAST_REF pointers
• TEB internals
• Prototype PTEs
• x64 kernel virtual address space
• System call internals
• Windows on ARM
• Interrupt dispatching
• KMDF internals
• WFP + WSK + AFD
• Kernel threads
• Physical memory analysis
• Driver development + debugging
There are also some absolute gems like using WinDbg to analyze/remove Poison Ivy RAT and a full catalog of key Windows kernel structures.
A lot of the material is older, but the fundamentals are still extremely valuable for understanding Windows under the hood.
Full FREE article archive:
codemachine.com/articles.htm…
Huge credit to @codemachineinc for keeping this material publicly available.
#WindowsInternals #ReverseEngineering #KernelDevelopment
Hai Tung retweeted
🍎🐛 I got Claude making this, maybe it's useful for others as well.
Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations.
apple-cve.com/
Hai Tung retweeted
Exploiting Reversing (ER) Series | Article 10: iOS Security Research (part 01)
223 pages, free. The first article in the series aimed at iOS itself, and the opening of a multi-part sequence.
Published on:
blackstormsecurity.com/resea…
This article will be published on exploitreversing.com/ next week.
I would like to thank Ilfak Guilfanov (@ilfak) and Hex-Rays SA (@HexRaysSA) for the continuous support.
Hope you enjoy the read!
#iOS #Apple #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering
Hai Tung retweeted
The TL;DR of what Anthropic just said:
1.) GLM-5.3 is as good as Mythos for exploit development.
2.) Unlike Claude, GLM-5.3 gives you the results you pay for.
3.) Governments should ban AI models which are as good as theirs but are not made by them.
The funniest part is how Anthropic admitted self-reflectively that the lack of guardrails may actually be benefiting the defenders working to secure their systems. 🤪
Something they never wanted to allow, because of possible misuse.
I don't get it, but I feel Anthropic should at least put a note at the very bottom if they are doing paid advertising to promote GLM-5.3. 😜
Source:
anthropic.com/research/glm-5…
Hai Tung retweeted
F5, BIG-IP, a 20-year-old primitive, a security appliance, an "authentication" mechanism - and a CISA promise ring.
Yes, it's CVE-2026-94127.
Give us strength. Speak soon xo
labs.watchtowr.com/is-this-a…
Hai Tung retweeted
SharePoint + Pre-Auth RCE + MemShell? 👀
We’ve published our technical analysis of CVE-2026-65660, covering the attack chain from an Allow Anonymous site and a pre-auth SharePoint vulnerability to RCE and MemShell.
Take a look:
blog.viettelcybersecurity.co…
Hai Tung retweeted
Been digging deep on this for the past week, fascinating stuff. I put together an analysis of the entire stack, plus a research harness to test things live.
Repo: github.com/marcosd4h/wesp-re…
Tech doc: github.com/marcosd4h/wesp-re…
Hai Tung retweeted
Sharing my for keynote talk for Offbyone security conference #OB12026 : <A year of hacking with LLMs>
sites.google.com/site/zhinia…
Hai Tung retweeted
CVE-2026-83991: GENERIC_WRITE and DeleteFileW both return error 5. Same token, CfCreatePlaceholders with SUPERSEDE returns S_OK. Same file ID, new IO_REPARSE_TAG_CLOUD. Microsoft’s affected range goes back to 2018. Writeup:
github.com/karollooool/CVE-2…
Hai Tung retweeted
Today we published WeWorm, our zero-click worm that spreads across iOS and Android.
All it takes is one phone call. You don't have to answer. Seconds later, your WeChat account is compromised, calling your friends and spreading the attack.
We reported the bug to Tencent, and it's now mitigated for all users.
We hope this sets an example. The US and China disagree on plenty, but keeping billions of people safe online shouldn't be one of them.
AI gives us a chance to find and fix these bugs faster than ever. We should work together to make the world safer for everyone.
Our story and demos: calif.io/research/weworm
