Android529 Natalie Silvanovich’s Part 3: the Pixel 9 0-click was person-weeks, not a miracle. Rare codecs on transcription, missing seccomp, kASLR dead since…
Android650 Seth Jenkins’s Part 2: from mediacodec to kernel R/W on Pixel 9 via CVE-2025-36934 in /dev/bigwave. A 16-second ioctl timeout UAF becomes…
Android699 Project Zero’s Natalie Silvanovich turns CVE-2025-54957 in the Dolby Unified Decoder into mediacodec code execution on a Pixel 9 with no tap:…
Exploit Development790 USENIX Security 2026: KERAT mines atomicity rules for check-use pairs on Linux and FreeBSD shared fields, then FSM-walks LLVM IR. 351 real…
Cisco498 Aaron Thacker jailbroke a Cisco C195 ESA by splicing a newer BIOS so CIMC came online, exploiting command injection in expRemoteFwUpdate (CVE-2024-20356)…
Defender614 On 8–9 September 2026 Nightmare Eclipse published ShieldCrash, a skeleton proof of concept that Microsoft's September engine update for ShieldBreak (CVE-2026-69414) closed…
Exploit Development711 CVE-2026-53360 is a heap out-of-bounds read/write in KVM SEV-SNP Page State Change handler: the guest picks the scratch buffer size, the host…
Exploit Development982 Two nginx rewrite-engine bugs share one root cause: an is_args flag computed in one pass and consumed in another. Pointed at r->args…
BYOVD798 CVE-2020-12446 in eneio64.sys does not corrupt anything. Its MAPPHYSTOLIN handler opens \Device\PhysicalMemory and maps the entire physical address space, read/write, into whichever…
Exploit Development629 Examining advanced shellcode architecture that eliminates reflective loaders while maintaining position independence and global instance management. This deep dive into the Stardust…
Exploit Development749 Every hardware security boundary on a modern x86 platform — SMRAM, the AMD PSP's private DRAM, the C6 save area, the live…
Defender772 On 12 August 2026 Nightmare Eclipse published ShieldBreak, a proof of concept that defeats Microsoft's July fix for CVE-2026-50656 (RoguePlanet) and escalates…
