FuzzingLabs

810 posts

FuzzingLabs banner
FuzzingLabs

FuzzingLabs

@FuzzingLabs

Research-oriented Cybersecurity startup specializing in #fuzzing, Vulnerability Research & Offensive security on Mobile, Browser, AI/LLM, Network & Blockchain.

Paris Katılım Ağustos 2020
3.7K Takip Edilen9K Takipçiler
Sabitlenmiş Tweet
FuzzingLabs
FuzzingLabs@FuzzingLabs·
💥 We’ve just raised €1M in pre-seed funding to accelerate the development of FuzzForge. When I started FuzzingLabs, everything was bootstrapped: our audits, our trainings, our R&D. No investors, no funding. Just a passionate team obsessed with offensive security and the belief that we could build something different. Three years later, we’re 30 and we are now entering a new chapter. This funding will allow us to: - accelerate the open-source development of FuzzForge, - build its marketplace of agents and workflows, - and expand the SaaS version to automate vulnerability research at scale. A huge thanks to @class_lambda and @ergodicgroup for their strategic support and trust in our vision: --> making offensive security more intelligent, collaborative, and automated. FuzzForge is already open source and under active development. You can check it out here: 🔗 github.com/FuzzingLabs/fu…
FuzzingLabs tweet media
English
5
41
270
20K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
We got the email too. We had a working RCE on Oracle Autonomous AI Database ready to demonstrate live at #Pwn2Own Berlin next week. ZDI confirmed they're at maximum capacity and can't add extra contest days. AI is now generating offensive capability faster than the institutions built to process it can keep up. We'll be in Berlin May 14-16 regardless. The conversations there will be really interesting!
FuzzingLabs tweet media
International Cyber Digest@IntCyberDigest

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots. Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy. ▪️ AI surfaces a massive wave of 0-day RCEs. ▪️ Submissions overwhelm ZDI past max capacity. ▪️ Slots run out. Researchers with working chains get rejected. ▪️ "Revenge disclosures" begin. ← we are here. Confirmed casualties so far: ▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land. ▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla. ▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere. ▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel. ▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected. ▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected. Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in. ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.

English
3
36
242
43.7K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
Our team found a Poseidon hash collision in Solana's Agave VM crypto syscall. Two distinct byte inputs → same field element → same Poseidon output. Affects both Agave and Firedancer via implicit padding paths. Full write-up: fuzzinglabs.com/solana-agave-v… Good job by @Ectari0
FuzzingLabs tweet mediaFuzzingLabs tweet mediaFuzzingLabs tweet media
English
3
15
68
5.3K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
New training is live: Reversing Modern Binaries - Practical Rust & Go Analysis 4 days, hands-on, built from real malware (Luca Stealer & others). Battle-tested at POC & REcon. 🎟️ Launch -20% with REVERSE20 Prefer in-person? See you at REcon Montreal 🇨🇦 👉 academy.fuzzinglabs.com/reversing-mode…
FuzzingLabs tweet media
English
0
2
13
1.5K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
New blog post: exploring NVIDIA’s open-source GPU drivers. Kernel modules, IOCTL attack surface, mmap primitives, UVM internals, and CPU↔GPU interactions (pushbuffers → firmware). Not just graphics: a large, exposed kernel surface. fuzzinglabs.com/exploring-nvid…
FuzzingLabs tweet media
English
0
31
99
5.5K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
If you're working on: - kernel security - fuzzing strategies - exploit development this case is a solid example of real-world bug anatomy. Full analysis: fuzzinglabs.com/repro-cve-2026…
English
0
1
1
320
FuzzingLabs
FuzzingLabs@FuzzingLabs·
We also share how we managed to exploit it: - which structures we sprayed to reclaim the freed memory - how we obtained leaks and an arbitrary read primitive - how we hijacked the control flow to achieve local privilege escalation on a production kernel
FuzzingLabs tweet media
English
1
1
0
465
FuzzingLabs
FuzzingLabs@FuzzingLabs·
We reproduced and analyzed CVE-2026-23111, a Linux kernel vulnerability in nftables that led to a use-after-free which we leveraged to achieve local privilege escalation. Full write-up: fuzzinglabs.com/repro-cve-2026…
FuzzingLabs tweet media
English
2
19
62
3.9K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
🚀 New training live: Masterclass – Scapy for Offensive Security Learn how to: • Craft & manipulate packets • Build & fuzz a DNS server • Do differential fuzzing • Reproduce real CVEs • Analyze parsing & overflow bugs Hands-on. Offensive. Practical. Enroll 👇 academy.fuzzinglabs.com/masterclass-sc…
FuzzingLabs tweet mediaFuzzingLabs tweet media
English
0
8
45
2.8K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
We just rewrote FuzzForge from scratch and open-sourced it. Old: Temporal + MinIO + workers + backend. Heavy. New: CLI + MCP server + containerized modules. Zero infra. 🖥️ Runs fully local 🧠 Plug your favorite LLM (Copilot, Claude, local models…) 🔗 AI agents orchestrate full security pipelines via MCP Demo: 4 modules, 3 min, 994 crashes → 3 unique bugs. AI-native security research. github.com/FuzzingLabs/fu…
GIF
English
4
29
182
10.8K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
🇨🇦 FuzzingLabs at @reconmtl Montréal 2026! This June, we’re delivering 3 advanced, hands-on trainings at REcon: 🦀 Rust Development for Cyber Security 🔍 Reversing Modern Rust & Go Binaries 📡 Attacking Real-World IoT & Embedded Devices 📅 June 15–18, 2026 🔗 recon.cx/2026/en/index.… Deep technical content. Real-world targets. No fluff. See you in Montréal 👋
FuzzingLabs tweet mediaFuzzingLabs tweet mediaFuzzingLabs tweet media
English
0
4
22
2.3K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
🚀 Open-sourcing MCP Security Hub A growing collection of MCP servers bringing security tools to AI assistants Nmap, Ghidra, Nuclei, SQLMap, Hashcat... and we're just getting started Contribute your favorite tools 🛠️ ⭐ github.com/FuzzingLabs/mc…
English
4
43
253
15.9K
FuzzingLabs retweetledi
TrendAI Zero Day Initiative
TrendAI Zero Day Initiative@thezdi·
Confirmed! Julien COHEN‑SCALI of @FuzzingLabs targeted the Phoenix Contact CHARX SEC‑3150, chaining two vulnerabilities - an authentication bypass and privilege escalation - to earn $20,000 USD and 4 Master of Pwn points. #Pwn2Own #P2OAuto
TrendAI Zero Day Initiative tweet mediaTrendAI Zero Day Initiative tweet media
English
5
10
33
5.2K
FuzzingLabs
FuzzingLabs@FuzzingLabs·
We just published Part 1 of our deep-dive on how we’re building #FuzzForge. Security tools exist. Orchestration doesn’t. FuzzForge chains SAST + fuzzing + dynamic analysis + AI agents into auditable, adaptive workflows, not black-box “AI hacking.” This is why we’re rethinking security automation 👇 fuzzinglabs.com/build-fuzzforg…
English
4
14
49
3.4K

Keşfet

@Ectari0 @ph0wn @cryptax @reconmtl @thezdi @BlackHatEvents @Pat_Ventuzelo @elonmusk