Peer-reviewed exploits, kernel bypasses, and verified solutions
A critical vulnerability in runc allowed containerized processes to acquire access to host file system root mounts through lingering file descriptors inherited during clone(CLONE_NEWNS).
@0xNullPtrExploiting a tight race window in a Linux 6.6 kernel module using userfaultfd and msg_msg spray to obtain arbitrary kernel write and modprobe_path overwrite.
@0xNullPtrReverse proxy header uncloaking combined with Next.js ISR (Incremental Static Regeneration) key poisoning to execute stored XSS on administrative dashboards.
@cyber_ghostRecovering the private key from 80 ECDSA signatures with 8 bits of nonce bias using Hidden Number Problem formulation and SageMath LLL reduction.
@cyber_ghostDumping dynamically decrypted OLLVM functions from .so memory using Frida hook on JNI_OnLoad and resolving control flow flattening with symbolic execution.
@bin_wizard