CSE Student | Interested in hypervisors, windows kernel and static binary analysis.
Joined September 2025
- Tweets57
- Following257
- Followers295
- Likes439
Happy to share that I found 3 EoP vulnerabilities in the Windows Secure Kernel:
CVE-2026-83939
CVE-2026-69846
CVE-2026-69906
Thanks to @msftsecresponse for coordinating the disclosure. I’ll share more details in a blog post soon!
CVE-2026-50392: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Another duplicate unfortunately but still got credits :D
Advisory: msrc.microsoft.com/update-gu…
vmpr0be retweeted
One of the interesting consequences of CDN caching is that you can exfiltrate data -using it as a covert channel- to anywhere from hardened sandboxes like the new vercel one, by only allowing a domain that supports it, here a PoC showing exactly that (IRC style):
vmpr0be retweeted
I found a guest -> host memory corruption bug in KVM.
Then I emailed the kernel security team.
Their response, basically:
Someone found it before you and the problem is bigger than what you found.
That second part hurt more. 🧵
CVE-2026-53360
blog.himanshuanand.com/2026/…
vmpr0be retweeted
VsockDrop: unprivileged Linux kernel LPE in the io_uring/vsock zerocopy path, no user namespaces needed. Bug affects Linux 6.7 -> 7.0.10, fixed in 7.0.11.
PoC video: Ubuntu 26.04 LTS on bare metal.
Exploit + mini write-up here:
github.com/MaherAzzouzi/vsoc…
Found 2 vulnerabilities in VirtualBox!
CVE-2026-47055: Oracle VirtualBox USB Card Reader Host Heap Buffer Overflow Vulnerability
CVE-2026-60158: Oracle VirtualBox VUSB Heap Buffer Overflow Vulnerability
Patch Update: oracle.com/security-alerts/c…
CVE-2026-57095: Win32k Elevation of Privilege Vulnerability
Duplicate but still got acknowledged which is nice.
kudos to wxz and Thanatos Tian!
Advisory: msrc.microsoft.com/update-gu…
vmpr0be retweeted
R3CTF 2026 has come to a successful close. Please join us in congratulating this year’s award-winning teams!
🥇 BBBB
🥈 EQST
🥉 @ProjectSEKAIctf
Thank you to our sponsors @nebusecurity @osec_io @zellic_io @vector35 @googlecloud
Hope see you next year!
vmpr0be retweeted
Special thanks to the organizing team and challenge author: @C15C01337 @bhprdp01 @0xUN7H1NK4BLE @prashantstha17 @StructHack @vmpr0be
See you in the next CTF. 🚩🫡
#HackAstra2026 #CTF #CyberSecurity #EthicalHacking #HackaSec #CaptureTheFlag
Authoring pwn for Hackअस्त्र CTF (ctftime.org/event/3270), it starts tomorrow!
vmpr0be retweeted
We are happy to share our ai-free (lol) research on the decade old ReDoS topic, we go through a couple findings, for example if you use IsPhoneNumber decorator in say your nestjs application, your currently trivially vulnerable to getting your server 🥶
mwlik.github.io/2026-04-15-r…
