Just dropped a new blog post! 🔥 blog.orange.tw/posts/2026-10…

How we chained three vulnerabilities into a full Chrome exploit in just 6 days—claiming Google’s first $250,000 full-chain reward of 2026 for an attack affecting an estimated 1 billion users. 🧵

We just received a $250,000 Chrome Full Chain bonus! 🎉 We've claimed the second Full Chain bonus of 2026. Only two remain! Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched. Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research. P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!

How pwn agents escaped the hardest-known sandbox setup: Google’s KVM (kvmCTF). pwn.ai/blog/kvmescape To celebrate 10K followers 🥳, we’re launching Stories from Inside the Sandbox, our new sandbox escape series.

Another month, another KVM escape. Patch if you're affected. openwall.com/lists/oss-secur…

A 250k calculator. Full blog post awaiting embargo 😎

Showing "how many cool 0days we found with our system" is fun, but more importantly, we all should continue iterating and improving on things that didn't work. Enjoy the blogpost! qedaudit.io/blog/brilliantly… (5/5)

We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…

testbnull.medium.com/hunting… Some note of recent Exchange Server Pre-Auth RCE! Have fun reading!

💥 Introducing "Zapscape" (CVE-2026-64561) A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU's recursive "ZAP" path. Can escape to the host on x86 public clouds that expose nested virtualization. A separate vulnerability from Januscape. If you match the vulnerable conditions, apply the patch immediately. Details: zapscape.io

Great post by @trailofbits - threat model - /goal fan out - variant analysis - agentflow (Easter egg from Figure 4) blog.trailofbits.com/2026/07…

GhostLock (CVE-2026-43499) is a 15yr old kernel 0-day we used in IonStack full chain exploit. Everything around you, as long as it runs Linux, from IoT to mobile to desktop, is affected. Read how we won $92,337 bug bounty with GhostLock and see our exploit on Github. Link below

💥 Introducing "Januscape" (CVE-2026-53359) A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU. Triggerable on both Intel and AMD hosts. Threatens x86 public clouds (GCP, AWS) that expose nested virtualization. "16 years" latent. Successfully used as a 0-day exploit in "Google kvmCTF". To the best of public knowledge, the first KVM exploit research triggerable on both Intel and AMD. Details: januscape.io

I found a Linux 0day vuln with @rqda_A, and $80,000+ rewarded for it by Google kernelCTF! The vuln has been surprisingly hidden for about 19 years. We've published an English version of the blog post! gmo-cybersecurity.com/blog/1…

Since V8 had heap sandbox, Chrome renderer RCE usually means chaining 2 bugs Today we bring the Spear of Longinus 1 bug, 100% success, no heap spray, found in 40+ major versions, arbitrary renderer read/write + V8 sandbox escape Our CVE-2026-6307 writeup nebusec.ai/research/v8-cve-2…

Hacking Google with A.I. for $500,000 brutecat.com/r/hacking-googl…

🚨 Introducing "ITScape" (CVE-2026-46316) A Guest-to-Host Escape in KVM/arm64. Guest-side actions alone exploit a use-after-free to run root-privileged code in the host kernel. Unlike the commonly published QEMU escapes, the bug lives in in-kernel KVM, not QEMU. On a successful exploit, commands run with host kernel privilege rather than the privilege of a user process, threatening the guest-host isolation of multi-tenant arm64 public clouds. To the best of public knowledge, the first Guest-to-Host Escape Exploit targeting in-kernel KVM/arm64. Details: itscape.io

Pwning V8CTF with a 0day in Chrome thanks to Phi untagging. Read here: kqx.io/post/cve-2026-4447/

4/4: Last but not least CVE-2026-40369 - Windows Kernel Arbitrary Increment primitive reachable from any browser sandbox renderer process This one was rejected from Pwn2Own and closed anyway yesterday :( My exploit is here - blogpost will be soon: github.com/orinimron123/CVE-…

i did it again 🙏🙏