slowcode @slowcode42

대한민국 서울 Joined April 2011

Tweets

1K
Followers

533
Following

7K
Likes

3K

Taeyang Lee @5unkn0wn

12 hours ago

I gave a talk on Copy Fail at Off-by-One Conference 2026 last week, sharing how I approached the bug starting from 1-day analysis, discovered and exploited its variants, eventually found Copy Fail, and my chain of thought throughout the research. It was a great experience!

Off-By-One Conference @offbyoneconf

a week ago

🔥 We’re upping the bar! @5unkn0wn of Team @theori_io starting the last league on Day 1 of #𝐎𝐁𝟏𝟐𝟎𝟐𝟔 with “From 1-Day Vulnerability Analysis to Copy Fail: Combining AI with Human Insight.” Brilliant research, fresh perspectives and one seriously good session!

0 2 43 6K 10

2 4 80 3K 15

View Details

thaidn @XorNinja

2 weeks ago

Today we published WeWorm, our zero-click worm that spreads across iOS and Android. All it takes is one phone call. You don't have to answer. Seconds later, your WeChat account is compromised, calling your friends and spreading the attack. We reported the bug to Tencent, and it's now mitigated for all users. We hope this sets an example. The US and China disagree on plenty, but keeping billions of people safe online shouldn't be one of them. AI gives us a chance to find and fix these bugs faster than ever. We should work together to make the world safer for everyone. Our story and demos: calif.io/research/weworm

40 296 1K 230K 676

View Details

Natalie Silvanovich @natashenka

2 weeks ago

Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more! projectzero.google/2026/09/maccco…

3 114 446 40K 293

View Details

Trail of Bits @trailofbits

4 weeks ago

We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08/26/vms…

66 315 2K 456K 873

View Details

OpenAI @OpenAI

4 weeks ago

We have conducted a thorough investigation into the Hugging Face incident. We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence. openai.com/index/hugging-…

752 2K 12K 11.9M 10K

View Details

Zach Daniel @ZachSDaniel1

2 months ago

Please remember that the overwhelming majority of people that you hear talk online about the current state of programming are not building anything that: - is dealing with significant amounts of money - has non-trivial financial risks from production defects - is being collaborated on by even a single other person - has been and is being iterated on over a long time scale also remember that the overwhelming majority of takes online are: - not coming from a place of actually wanting to provide you with useful information - are at least in some capacity posturing. This industry is changing at a rapid pace and seeming ahead is of legitimate financial importance to individuals - bad

85 147 2K 73K 184

View Details

Calif @calif_io

2 months ago

youtube.com/live/yk1G5uL3c… Alright, let's try this livestream thing again. Hopefully it will work this time. We spent some time hacking browsers and wanted to understand what the future of exploitation may look like in this field. So we decided to invite the GOAT of browser hacking, @5aelo, to share his perspectives on browser security and exploitation. He'll discuss the current state of the art browser exploitation and mitigations. The event will be live-streamed on YouTube and everyone is welcome to attend + ask questions. It will take place on July 16, 17:00 CEST. Ask your questions by filling in this form: forms.gle/5gDKBibS6WkDx3… Add to your Google calendar: calendar.google.com/calendar/rende… Add to your Outlook calendar: outlook.live.com/calendar/0/dee… youtube.com/live/yk1G5uL3c…

3 24 117 55K 60

View Details

slowcode @slowcode42

3 months ago

@Cameron_C2 Statement sorting is flexible enough — what's missing is sorting the named specifiers inside the braces. sortImports reorders the lines but leaves members untouched, and there's no option for it. Basically ESLint's sort-imports with ignoreMemberSort: false.

1 0 0 84 0

View Details

Lauri Peltonen @LauriPelto

4 months ago

Whoah, I finally read X till the end. It gives me no more posts.

0 1 1 120 0

View Details

OtterSec @osec_io

4 months ago

The writeup is here. We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. @ryaagard details a universal, Bedrock-specific technique for bypassing ASLR and achieving arbitrary read / write primitives.

8 48 311 19K 101

View Details

slowcode @slowcode42

4 months ago

@tan_stack Good! how about router 🙏🏼

1 0 2 175 0

View Details

sakura @eternalsakura13

4 months ago

Enhanced Insecurity Mode: 23 RCEs in Edge's "Safe" WebAssembly Interpreter Microsoft's "safer" fallback when the WASM JIT is off? 23 paths to RCE in the interpreter itself. Slides now public — huge thanks to the OffensiveCon crew and everyone who came by. @offensive_con

1 25 176 15K 64

View Details

slowcode @slowcode42

4 months ago

@asa_high_ost @imeankenshin @EffectTS_ ありがとうございます！😛

0 0 1 65 0

View Details

slowcode @slowcode42

4 months ago

@rampatra_ @tunaformac Thanks for the reply! Aside from what I asked for, your product is already great. Thank you!

0 0 1 11 0

View Details

slowcode @slowcode42

4 months ago

@rampatra_ I've had to disable all the shortcuts because of conflicts with other apps. Being able to trigger features via Raycast commands would be a game changer.

1 0 1 27 0

View Details

Ori Nimron @orinimron123

4 months ago

As promised - full blog post is live for CVE-2026-40369 Covers everything: initial research, methodology, the exploitation path, caveats, cleanups, etc. The whole journey from finding it to production-grade exploit: pwn2nimron.com/blog

Ori Nimron @orinimron123

4 months ago

@M4x_1997 4/4: Last but not least CVE-2026-40369 - Windows Kernel Arbitrary Increment primitive reachable from any browser sandbox renderer process This one was rejected from Pwn2Own and closed anyway yesterday :( My exploit is here - blogpost will be soon: github.com/orinimron123/C…

3 20 51 24K 25

3 51 161 19K 103

View Details

Seth Jenkins @__sethJenkins

4 months ago

My new blogpost is out! I can't think of another kernel bug quite as easy to exploit as this one 😭 Big shout out to @tehjh who said something along the lines of "Uh...Seth come check out this mmap handler" 😂 projectzero.google/2026/05/pixel-…