This was quite a ride :) I'm incredibly proud of XBOW's Native Team for their work on this, and looking forward to sharing details on the chain once we're able to!

Are there adversarial examples one could generate for its word break detection LSTM? Call that a Thai-breaker

We can use our Ghostscript exploits to directly attack KDE's file manager from a single link click in Chrome. This PoC Downloads the file, then pops open the file manager for unsandboxed RCE (lovingly refered to as the full chain from temu)

Robert's work on rr is something I deeply respect (and use all the time – genuinely transformative for debugging), and it is worth taking what he says seriously.

Little Free Library near me… we might have a few nerds around here

True but before machine learning many people who studied physics came to the conclusion that their talents were best directed toward optimizing quantitative finance or advertisements

Australia has been hacked. 'And today, I spoke with the CEO of OpenAI, Sam Altman, to express Australia's extreme concern about this incident. And I also expressed my disappointment that it took the company way too long to inform the government what had occurred, and the nature of the way that that notification occurred as well was unacceptable.'

The vulnpocalypse has enter the zeigiest, and the technical debt can no longer be ignored. 🫣 @caseyjohnellis shares his thoughts about what that means for the state of bug bounties and more in the latest episode of Offense Taken. piped.video/watch?v=MYLvQpXE…

Great talk, and these were also the most visually stunning slides of the conference!

Surely someone has done this already

Known (already publicly found/fixed upstream) - ~12 of our leads: Our audit independently rediscovered several bugs that upstream has been fixing in a heavy wave between April–August 2026 (much of it credited to an autonomous research program called "XBOW," one to a human.

ESCAL8, Google’s annual flagship security conference, is coming to Singapore in October 2026, with a particular focus on AI Agents! 🇸🇬 Check out our blog post to see what's planned in the three main segments of the conference: bugSWAT, Hackceler8, and init.g() 👇 bughunters.google.com/blog/e…

Our own Mr. Q had his Chrome hack featured in the latest Phrack. Since July and toward the end of the year, we are sharing our latest research at the following conferences: Black Hat USA, Unprompted.au, Blue Hat, Off By One, BSides Canberra, Hexacon, Objective By The Sea, and OffensiveCon.jp. It's hard to believe we only launched this research program in March. It shows how much can be accomplished with AI and the right people working together. We'll be sharing more fun results in the coming weeks. Stay tuned!

I spent the weekend pushing Nym as far as it could go with Jev. If you're interested in making your agents: - Faster - Cheaper - More reliable Read through the blog post for an excellent dive into benchmarking and performance characteristics. usenym.com/technical-blog/re…

Huge props to @mdowd and the @UnpromptedAU crew for an incredible con. Great sessions from @uglypackets, @ShaneHuntley, @chompie1337, @moyix, @caseyjohnellis, plus AU domestic capability, Slack D&R and TikTok’s privesc hunting. Lots to think about, looking forward to next year!

The @UnpromptedAU crew did an amazing job. It had the feel of a local BSides but with 400 people and a global lineup of talks. @chompie1337’s BinChomp talk was pro @moyix packed 45m of joyful hacking into 15m Tristan Steele and Jasper Van Woudenberg showed their AI w/ HW tech