b33f | 🇺🇦✊ @FuzzySec

@kennethlau12393 I'm not settled on this yet but I can post an update later

I am evaluating secure sandbox surfaces for high-trust agent environments (benchmarking, SFT, expert on-policy supervision, outcome based RL, etc). Obviously there are some pre-baked solutions, one that is attractive is Docker's sbx (docker.com/products/docke…). Sbx runs agents inside isolated Linux microVM's with their own kernel and private Docker Engine. They use filesystem passthroughs and host-side bridges to facilitate file access, networking, mcp tool usage, credentials, etc. These microVM's offer a very strong execution boundary but obviously the brokers are a major attack surface. Looking through the changelog for sbx, the situation is a bit more grim than you would expect. Between June 1 and today (Oct 24) there are 9 CVE's including critical issues (like a macOS virtio-fs escape CVE-2026-77179). These look like typical logic issues you might expect. What's interesting though is that the changelogs also reveal areas that got security fixes but no CVE. For example, a full broker mediated guest-to-host escape, shown in the poc below (on v0.39.0 before Sept 7). Some light reverse engineering was required since you don't get core implementation source. Pre-patch a sandbox could supply DBUS_SESSION_BUS_ADDRESS through the guest-controlled host_env sent to the host browser bridge. On the Linux host, the bridge passed that environment to xdg-open, whose desktop-detection path invoked dbus-send, which accepts a "unixexec:" address leading to code execution.

We just received a $250,000 Chrome Full Chain bonus! 🎉 We've claimed the second Full Chain bonus of 2026. Only two remain! Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched. Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research. P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!

We’re publishing a full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12. 🔗 eshard.com/blog/kernel-ua…

Introducing Kimi K3.1 Pro: our most capable 3T-class open-weight model. 🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal. 🔹 Full-project coding: games in Unreal, Unity & Godot. 🔹 Excels at parametric 3D modeling in Blender & CAD. 🔹 More reliable at finance work: Accurate modeling with hallucination down by 65%. 🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks. Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API. Open weights by Nov 4, 2026. 🔗 API: platform.kimi.ai 🔗 Tech blog: kimi.ai/blog/kimi-k3-1…

@OphirHarpaz It’s been a common experience for me also

next time you're thinking about researching the linux kernel (@linuxfoundation), remember that someone on the receiving end of your report might talk about you like this: in one of the threads, kernel maintainer "Peter Zijlstra" decides to call the ZDI team "monkeys" there's a longer argument about how ZDI submits reports, whether they should include patches, and how fixes get tested. fair enough, have that discussion but how does insulting the people reporting vulnerabilities help? i thought the kernel's code of conduct was something everyone on these lists was expected to follow sad to see people spoken to like this while trying to help improve linux security. crime scene: lkml.iu.edu/2610.2/16616.h… lkml.iu.edu/2610.2/16917.h…

keyboard_arrow_left Previous keyboard_arrow_right Next

New on our Frontier Red Team blog: using Claude to formally verify software at large scale. Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time). With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks. Read our research in full here: anthropic.com/research/forma…

today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for. we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows. how we built it: cantina.security/apex-flash

Starshield is used as part of operations that have significant national security implications (for example the NRO in the US). These services are also provided through strict contracts in Europe. When they are used arbitrarily for political coercion, violating those terms, they must be restricted and phased out. It's unbelievable that this is even in question. Either a contract has value or it has no value at all.

Financial Times @FT

7 days ago

US threatens Europe over Starlink restrictions ft.trib.al/0KUTiUQ

713 1K 3K 1.1M 510

this is just wrong: these vulns were found by defenders using Daybreak rather than attackers. It's just evidence Glasswing didn't go far enough, possibly due to capacity constraints. It's also very likely that March Mythos was not as good as Sol/Astra of September

Nate Soares ⏹️ @So8res

4 days ago

It's striking that this vulnerability was found by Sol and Argon rather than being found and fixed in the wake of Mythos 6mo ago. Seems like a heavy strike against the "defense will run ahead of offense" theory, especially give that domains like bio are much harsher than cyber.

45 54 740 145K 128

@lcfr_hax

Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: x.com/lcfr_hax/statu… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.

LCFR @lcfr_hax

3 months ago

d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac

49 112 1K 669K 485

php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell

5.10-6.18 Linux Kernel 漏洞提权root，可自行测试 Github仓库：github.com/mitschud/Dirty… 提前安装好KernelSU

keyboard_arrow_left Previous keyboard_arrow_right Next

@S1r1u5_ @Laughing_Mantis I agree vendors have been chronically underpaying researchers for their work. This is one of my favorite examples, RCE in Teams: github.com/oskarsve/ms-te…

What do you mean 5k?

Karim @kymu___

a week ago

RCE in Discord 👀 bugcrowd.com/disclosures/63…

19 43 676 192K 451

@Laughing_Mantis Mind you, I think the real issue here is the chain up to v8. They should probably pay out RCE as soon as you can demonstrate JS execution (at a much higher price than 5k)

The truth is that we are probably somewhat cooked. I'm going to go out on a limb here and say that the electron runtime has outdated v8 (I know steam does, I checked and reproduced primitives from a deeplink). Companies probably can't keep up and I think we are in for a difficult time in the next 12-24 months. Still, I think it's just not right that companies are hovering up researcher IP and paying them peanuts.

Models can compress work to an extreme degree. This is especially relevant in highly complex domains where equivalent efforts may take humans hundreds of hours. Of course we want (and need) to leverage this but we risk outputs becoming hard to understand, inspect and verify. These outputs also need to return value back to the human or there is a danger of being put out of the loop. The blogpost is an attempt to work on legibility, this is an ongoing effort, and to give value back to such a rich technical community 🫶

As you will see this post is a bit special. Increasingly we need the grapple with making model research legible to humans (as in mathematics) so this was an excellent opportunity to tune my style guide and have models do the reporting themselves. knifecoat.com/Posts/Pok%C3%A…

We are back today for round 3! We proved out and chained a number of theoretical primitives, drawing from excellent community work, to eventually load our own VM inside pokemon red. The subject matter is quite complex so I also produced a full blogpost linked 👇

keyboard_arrow_left Previous keyboard_arrow_right Next

b33f | 🇺🇦✊ @FuzzySec

3 months ago

Round 2, fight! GPT5.6 chains together an impressive set of techniques to gain ACE and uses that to render a Mortal Kombat logo in-game. End-to-end the model took 30-40 minutes to produce and validate the full chain. I assume we achieve SOTA here in Pokemon Red exploitation 👻

keyboard_arrow_left Previous keyboard_arrow_right Next

5 8 81 18K 25