@voydstack

VR @Synacktiv | CTF with @RMUBYGG, @Hexagonctf, @ECSC_TeamFrance 20/21/22/23/24

 France
voydstack.re
Joined August 2018
  • Tweets736
  • Following1K
  • Followers2K
16Media
voydstack retweeted
poly@_p0ly_
Sep 26
Fable and I were able to double the speed of MLX.fast challenge the total improvement is now 269.2%
3
4
17
824
voydstack retweeted
V4bel
@v4bel
Sep 16
Another month, another KVM escape. Patch if you're affected. openwall.com/lists/oss-secur…
3
21
1
108
9,134
voydstack retweeted
Hexacon@hexacon_fr
Sep 11
The wait is over! 🚀 The talks for Hexacon 2026 are officially out, and the lineup is absolute fire 🔥 hexacon.fr/conference/speake…

Hexacon - Conference – Speakers

Discover the accepted talks for this edition!

hexacon.fr
2
23
6
53
15,794
voydstack retweeted
GreHack@GrehackConf
Sep 9
CFP IS STILL OPEN FOR TALKS ! GreHack 2026 is coming soon... 🫣We invite you to share your talk about a cybersecurity topic of your choice ! 😁 Go now at GreHack.fr to send your talk before it's too late !👀Ending at the 13th.⌚ Thanks to everyone ! Cheers ! 🍻
6
7
831
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more! projectzero.google/2026/09/m…

Testing race conditions with memory access tracing and stack-based delay injection

Many security bugs are race conditions, where multi-threaded execution has to occur with the righ...

projectzero.google
3
114
4
447
40,132
A logical bug that I've reported to MariaDB has just been disclosed! 🎉 It's a nice logic issue that allows any user (no matter their rights) to update the password of any other user, including root :D You can find more details 👇 hackerone.com/reports/387643…
8
157
25
828
157,894
voydstack retweeted
Entrypoint@Entrypoint_fr
Sep 7
🔥 What are you bringing to #Entrypoint? New technique? Tool release? Real-world compromise? Deep technical offensive security talk? 🎤 CFP closes 20 September. 📅 19-20 March 2027 | 📍 Paris ➡️ cfp.entrypoint.fr/entrypoint…
1
11
14
2,084
voydstack retweeted
Hexacon@hexacon_fr
Sep 3
Check your inboxes! All CFP responses have been sent out 📩 A huge thank you to everyone who submitted. We were absolutely blown away by the sheer volume and incredible quality of your proposals. Making the final selection was very tough!
1
8
12
1,845
voydstack retweeted
Boschko
@olivier_boschko
Aug 27
I've published UniBLEed, a fully wormable proximity Bluetooth RCE affecting Unitree's G1 humanoids. Blog spans cloud, mobile, firmware, Bluetooth & hardware. Two multi-bug RCE chains. 3 months into ~80 minutes, $6,700 in bounties. Go jailbreak your G1s!! boschko.ca/g1-ble-rce/

UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range

Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree’s cloud, mobile, and the firmware running the G1 itself. Here’s the complete technical breakdown of the...

boschko.ca
10
83
10
225
24,199
voydstack retweeted
OpenAI
@OpenAI
Aug 26
We have conducted a thorough investigation into the Hugging Face incident. We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence. openai.com/index/hugging-fac…

The Hugging Face incident and the road ahead

OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.

openai.com
751
1,514
1,110
11,568
11,913,242
voydstack retweeted
V12
@v12sec
Aug 26
Signal's Contact Discovery automatically sends your contact list information to an SGX enclave in the cloud. V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything. Two separate critical bugs: arbitrary read and RCE. Here's how. 🧵
17
146
41
723
137,371
voydstack retweeted
Qwen
@Alibaba_Qwen
Aug 26
⚡Meet Qwen3.8-Flash, a multimodal MoE and an early preview of the Qwen4 architecture, now open-weight! The production version Qwen3.8-Flash will be available soon via QwenCloud API at just $ 0.16/1M input tokens and $ 0.47/1M output tokens. 125B parameters + 51B N-gram embeddings, with just 6B activated per token. Unmatched cost-efficiency. What's new: 🥳 - Next architecture: GDN + QSA hybrid attention, Gated Residual, N-gram Embedding & Muon optimizer, serving as a precursor to the architecture used in Qwen4. - Dramatically lower training and inference costs: trained at just 1/9 the cost of Qwen3.7-Plus, while outperforming it across the board with especially strong gains in coding and office tasks. - Strong performance: scoring 58.7 on DeepSWE 1.1, 62.5 on SWE-bench Pro, 73.9 on CoWorkBench, 84.5 on AndroidWorld, and 95.7 on MathVision (with CI). - 262K native context, extensible to 1M with YaRN. We’re also releasing the weights for Qwen3.8-Flash-Next, giving the community an early look at the new architecture we’re exploring for Qwen4.🚀 We can't wait to see what you build with Qwen3.8-Flash!👀👇 - Blog: qwen.ai/blog?id=qwen3.8-flas… - Technical Report: github.com/QwenLM/Qwen3.8-Fl… - Hugging Face: huggingface.co/Qwen/Qwen3.8-… - ModelScope: modelscope.cn/models/Qwen/Qw…
459
1,036
565
7,930
1,911,092
We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…

VMs won't contain cyber-capable agents

You can no longer assume a mere VM will contain a sufficiently advanced AI agent.

blog.trailofbits.com
70
333
100
1,697
491,837
voydstack retweeted
Synacktiv
@Synacktiv
Aug 26
Envie de développer vos compétences en sécurité des systèmes embarqués ? 🔐 Inscrivez-vous à notre formation : 📅 Embedded Systems Exploitation : 19-23 oct. Firmware, QEMU, analyse statique, fuzzing AFL++ et exploitation de vulnérabilités ⬇️ synacktiv.com/offres/formati…
3
8
2,110
voydstack retweeted
DARKNAVY
@DarkNavyOrg
Aug 25
We just got a root shell on a @Starlink terminal antenna! To our knowledge, this is the first full exploit of a "square dish" since @LennertWo's attack on the "circular" one in 2021. @SpaceX security team has done an amazing job, leaving us no choice but a *hardware attack* to achieve this 👏 The demo below shows what's only possible on actual rooted hardware: reading fuse register contents, accessing hardware-encrypted "file_edr" data, and more.
19
141
15
1,005
112,690
voydstack retweeted
Jiska@naehrdine
Aug 23
Want to learn firmware reverse engineering on an IoT device? I'll be giving a free, women-only workshop with BlackHoodie at Hexacon in Paris on October 15. #reverseengineering blackhoodie.re/Hexacon2026/
Debugging a Pico with a Pico. Photo credits: Sandra Cava

ALT Debugging a Pico with a Pico. Photo credits: Sandra Cava

1
16
39
2,635
voydstack retweeted
Hack'n Speak@hacknspeak
Aug 24
🎙️🇫🇷 Nouvel épisode du podcast Hack'n Speak accompagné de @kevin_mizu 🔥🥇 Épisode dédié à son parcours, ses recherches, son XSS DOMPurify et bien sûr un peu, beaucoup d'IA :) Bonne écoute à toutes et à tous 🎶 creators.spotify.com/pod/pro…

0x38 Mizu | Recherche de 0days et XSS dans dompurify by Hack'n Speak

Kevin Mizu website https://mizu.re/RCE wordpress: https://wp2shell.com/Twitter Mizu https://x.com/kevin_mizuTwitter mpgn https://x.com/mpgn_x64

creators.spotify.com
2
20
2
60
10,266
voydstack retweeted
Michal Melewski@carste1n
Aug 20
Finally it got published.
Cloudflare
@Cloudflare
Aug 19
We found a working remote Spectre attack against Cloudflare Workers. We already fixed it. No exploitation in the wild. Blog post and paper out now: cfl.re/4qKdP6V

A revisit of remote Spectre attacks on Cloudflare Workers

In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and...

blog.cloudflare.com
6
69
9,051
voydstack retweeted
Entrypoint@Entrypoint_fr
Aug 18
🚨 The Entrypoint 2027 CFP is still open! AD, Cloud, CI/CD, Initial Access, web exploitation... if you've got a technique or a real-world engagement story, we want to hear it. ➡️ cfp.entrypoint.fr/entrypoint… 🎫 Website and ticketing information will be released soon!
9
1
13
882
Recently, I've been looking at DOMPurify again, trying to find ways to bypass 3.x.x after browsers started encoding attrs during serialization. I ended up with a nice ≤3.2.6 Safari default-configuration bypass using only SMIL tags/attrs :D Details 👇 mizu.re/post/dompurify-bypas…
https://yeswehack.github.io/Dom-Explorer/shared?id=9c1f671a-fc8f-4284-9217-eba4df143db3

ALT https://yeswehack.github.io/Dom-Explorer/shared?id=9c1f671a-fc8f-4284-9217-eba4df143db3

5
55
255
10,754
Load more