pacbypass

302 posts

pacbypass banner
pacbypass

pacbypass

@pacbypass

in gulag for causing a double free

Katılım Aralık 2019
1.6K Takip Edilen336 Takipçiler
pacbypass retweetledi
blasty
blasty@bl4sty·
I feel the traditional "responsible disclosure" concept has been broken since its inception. you can argue that forcing everyone's hand by dropping (weaponized) bugs/exploits is reckless/harmful behavior or blablabla but I feel you have to keep in mind everyone's stakes/motivation in the game are different. one thing I guess we can agree on: people sit on bugs/exploits all the time. sometimes because ZDI promises a big bag of money at the end of the rainbow that magically evaporates and sometimes because they don't want to disclose these things and use them tactfully for their own advantage/goals. I've always felt forcing this acceleration will (hopefully) get the software landscape in better shape, faster. albeit in a messy way. the noise it creates however could be a good signal for people to get an idea of the overall security posture of a piece of software, as well as get a good idea of how a vendor handles disclosures that don't follow their made up fairytale non-enforceable policies. (that typically don't come with any kind of silver lining) back then, you could be damn sure that another horde of teenagers grep'd the same src tree for memcpy and was probably also sitting on an exploit. today the same applies, anyone can out-slop you producing the next linux LPE after brad tweets out a commit ID remember: as a researcher you don't own the vendor anything. you don't own the public anything either. if you did this work for free its yours to publish in whatever way suits your needs, agenda or overall quirkiness. :)
Luke Stephens (hakluke)@hakluke

I'm seeing this question being asked a lot! I think the traditional 90+30 day responsible disclosure standard is dead (or should be). It's too dangerous to be holding onto vulns for this long now. I've been thinking about alternative responsible disclosure policies that work better for a post-AI era but it's a pretty tricky problem!

English
6
28
90
13.1K
pacbypass retweetledi
FuzzingLabs
FuzzingLabs@FuzzingLabs·
We got the email too. We had a working RCE on Oracle Autonomous AI Database ready to demonstrate live at #Pwn2Own Berlin next week. ZDI confirmed they're at maximum capacity and can't add extra contest days. AI is now generating offensive capability faster than the institutions built to process it can keep up. We'll be in Berlin May 14-16 regardless. The conversations there will be really interesting!
FuzzingLabs tweet media
International Cyber Digest@IntCyberDigest

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots. Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy. ▪️ AI surfaces a massive wave of 0-day RCEs. ▪️ Submissions overwhelm ZDI past max capacity. ▪️ Slots run out. Researchers with working chains get rejected. ▪️ "Revenge disclosures" begin. ← we are here. Confirmed casualties so far: ▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land. ▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla. ▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere. ▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel. ▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected. ▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected. Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in. ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.

English
3
36
241
44.4K
pacbypass retweetledi
impulsive
impulsive@weezerOSINT·
So he found a real ffmpeg bug with a fuzzer then let gemini convince him it was a chrome RCE. wrote a fake proof of concept that doesn't even use ffmpeg, just his own code writing past his own buffer going "look RCE!" google asked if it works in a browser. he said "me and gemini have been trying to figure that out." it did not work in a browser. wontfixed.
impulsive tweet media
dawgyg - WoH@thedawgyg

Well since Google sucks fat donkey dick (still annoyed they waited >2 months to reject my RCE payload because i used the --single-thread flag in repro)... This was disclosed yesterday: issuetracker.google.com/u/1/issues/478… It was my 1st attempt to report the vuln that allows for RCE on every Chromium browser since Dec 2018. This one was rejected because I was still learning how to prove Chrome reachability. Ended up filing a new report a week later after figuring out a trick to bypass Chromium's validation on video files and being able to prove reachability.

English
16
27
708
90.1K
FalconFeeds.io
FalconFeeds.io@FalconFeedsio·
🚨DDoS Alert 🇵🇱 NoName claims to have targeted multiple websites in Poland. - PCO S.A. - PIT-RADWAR S.A. - Zakłady Metalowe DEZAMET S.A. - Urząd Marszałkowski Województwa Dolnośląskiego - City of Rzeszów - BLIK - MPK Poznań Sp. z o.o.
FalconFeeds.io tweet mediaFalconFeeds.io tweet media
Polski
2
7
35
10.3K
pacbypass
pacbypass@pacbypass·
@b1ack0wl If the text go very fast it very smart yes?
pacbypass tweet media
English
0
0
2
125
pacbypass
pacbypass@pacbypass·
@h0mbre_ That's what I was wondering, does that include qemu? Even kvmctf is starting off at 50k for an oob read, but kvmctf doesn't have qemu in the scope
English
1
0
2
1.2K
h0mbre
h0mbre@h0mbre_·
kvm at pwn2own is only $50k, that is surprising to me. maybe im just ignorant, but seems like a super hard target
English
6
1
117
12.6K
Bien 🇻🇳
Bien 🇻🇳@bienpnn·
@pacbypass if its pure kvm then i think 50k is underpaid by a wide margin
English
1
0
4
159
Bien 🇻🇳
Bien 🇻🇳@bienpnn·
oh well right when i'm testing my potential findings against virtualbox, they announced that it will not appear this year. guess it's time to suffer with vmware disassembly again...
TrendAI Zero Day Initiative@thezdi

Announcing #Pwn2Own Berlin 2026! We've got 10 categories for targets, including an expanded #AI target list. We have 4 AI categories - including coding agents (looking at you #Claude). More than $1,000,000 in cash & prizes available. Read the details at zerodayinitiative.com/blog/2026/3/11…

English
1
0
20
4.5K
Krzysztof Gawkowski
Krzysztof Gawkowski@KGawkowski·
⚠️Ważna informacja.⚠️ Zidentyfikowaliśmy próbę ataku hakerskiego na serwery Narodowego Centrum Badań Jądrowych. Działania hakerów zostały udaremnione, wszystkie procedury zadziałały. NCBJ jest w bieżącej koordynacji ze służbami państwa, w tym NASK oraz Ministerstwem Energii. Trwa poszerzona analiza zdarzenia. Obecnie nie identyfikujemy zagrożeń dla działalności Narodowego Centrum Badań Jądrowych. O wynikach ustaleń będziemy informować na bieżąco.
Polski
86
112
469
57.1K
pacbypass
pacbypass@pacbypass·
@_L4ys First time seeing it ever, crazy.
English
0
0
0
160
L4ys
L4ys@_L4ys·
First time seeing this status change Is everyone finding bugs with AI now?
L4ys tweet media
English
4
1
43
4.8K
wallfacer
wallfacer@simplylurking2·
this lead to me chasing a rabbit hole til 5am and coming out with a working prototype before sleep. helps making prioritization mistakes in RE much less expensive. for instance, i chased down 2 other wrong paths before finding the right one, and it just cost hours, not days
English
4
0
6
300
wallfacer
wallfacer@simplylurking2·
ghidra headless does indeed slap for agent-assisted research. Im just surprised how I didnt really need to setup a harness/MCP. max lazy: "use ghdira headless, write scripts, chase down 'XYZ' functionality in this giant stripped ELF binary. show me call graph and where to hook"
English
4
3
50
4.3K
pacbypass retweetledi
Mahmoud Al-Qudsi
Mahmoud Al-Qudsi@mqudsi·
Down to a handful of errors in the recovered pdf!
Mahmoud Al-Qudsi tweet media
English
384
2K
27.8K
7.5M
pacbypass retweetledi
SSD Secure Disclosure
SSD Secure Disclosure@SecuriTeam_SSD·
🚨 New advisory was just published! A flaw that exists within the handling of sch_cake can allow a local user under the CentOS 9 operating system to trigger an use-after-free. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. This vulnerability won first place in the Linux category during the TyphoonPWN 2025 event: ssd-disclosure.com/linux-kernel-n…
English
3
13
84
483.2K
pacbypass retweetledi
Mari0n
Mari0n@pinkflawd·
I've only spent a hot 5 min, but the level of obfuscation in the September version of Lockbit for Linux is marvelous
Mari0n tweet media
English
15
38
660
53.8K
pacbypass retweetledi
React
React@reactjs·
There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it. A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately. react.dev/blog/2025/12/0…
English
161
1K
3.9K
2.6M

Keşfet

@jestem_stary @FalconFeedsio @MSWiA_GOV_PL @NASK_pl @PolicjaCBZC @b1ack0wl @h0mbre_ @bienpnn