Zurich, Switzerland
Joined August 2011
- Tweets1.3K
- Following534
- Followers10.3K
- Likes1.8K
Pinned Tweet
My latest Chrome bug just got derestricted.
Did you know that floats have a minus zero? Turns out if you forget about it, that can mean RCE :).
bugs.chromium.org/p/chromium…
stephen retweeted
Just dropped a new blog post! 🔥
blog.orange.tw/posts/2026-10…
I was disappointed that nearly nobody at #OffensiveCon remembered Holey Beep from 8 years ago.
A bug in the setuid beep binary beep. You had to win multiple races to write 4 bytes of uninitialized memory to an arbitrary file.
And ofc, the man page boasted that it's unhackable.
stephen retweeted
After a few years in beta, the V8 Sandbox is now considered a real security boundary! (Just announced at OffensiveCon Tokyo together with @mlippautz). This is less about reaching a particular software milestone than about two things:
stephen retweeted
100 V8 Exploits: lessons learned from three years of v8CTF by @_tsuro and Carl Smith
stephen retweeted
Agenda for OffensiveCon Tokyo 2026 is live!
Explore the talks and plan your schedule now:
offensivecon.jp/agenda/2026.…
#OffensiveCon #Tokyo
stephen retweeted
Glad to announce IERAE CTF is back!
AI killed CTF? We believe we're not done yet!
Bring your insight or an agent that proves us wrong 😄
IERAE CTF FINAL for Humans Round 1
- Oct 10, 00:00 UTC
- 1 chal, 8 hours
- $1,000 in prizes
IERAE CTF 2026 — FINAL for Humans #1
One Web challenge. A vanilla AI agent couldn't solve it in testing. AI is welcome.
October 10 · 09:00 JST
alpacahack.com/ctfs/ierae-fi…
stephen retweeted
Today I'm joining Anthropic to lead the cybersecurity mission of the Frontier Red Team.
In my career I've never seen a clearer opportunity to build a more secure world for everyone. For 40 years we've lived with fundamentally insecure technology. What will it take to make the past 40 years of hacking a historical oddity? That's what I'm here to find out.
Super excited to work with @logangraham and the rest of the FRT crew.
stephen retweeted
During my time at @QED_Audit I circled back and took another quick look at browser/JSE vulnerability research. AI agents flying high, seemingly finding & exploiting bugs everywhere, and there's this: a **constant integer overflow** in V8, alive for over 3.5 years. (1/5)
@QED_Audit found CVE-2026-19174, an integer overflow in V8 that gives you arbitrary code execution in Chrome. The bug is one line of constant arithmetic. It survived 3.5 years of fuzzing, manual audit, and LLM-driven review. (1/n)
stephen retweeted
I found a Linux 0day vuln with @rqda_A, and $80,000+ rewarded for it by Google kernelCTF!
The vuln has been surprisingly hidden for about 19 years.
We've published an English version of the blog post!
gmo-cybersecurity.com/blog/1…
Linux kernelで19年以上見過ごされていた0-day脆弱性を報告しました
悪用されると一般ユーザーからの権限昇格が可能になる脆弱性です
詳しくはこちら
gmo-cybersecurity.com/blog/1…
stephen retweeted
We won v8CTF, with Codex!
This is the first confirmed 0day entry in v8CTF since Oct 2025. Our entry was submitted on June 19, at the bottom:
docs.google.com/spreadsheets…
Full technical writeup and PoCs will be released after the bugs are fixed.
stephen retweeted
This Williams story is crazy. The documents only leave more questions. How did L3Harris (company 1) learn about the sales to Operation Zero (company 3)?
Were they able to attribute their own exploit (item 3) by looking at the rop chain or did he legit leave the headers in?
stephen retweeted
Here's my Wired story about his guilty plea and what prosecutors revealed in this morning's hearing: wired.com/story/peter-willia…
stephen retweeted
We derestricted crbug.com/382005099 today which might just be my favorite bug of the last few years: bad interaction between WebAudio changing the CPU's handling of floats and V8 not expecting that. See crbug.com/382005099#comment1… for a PoC exploit. Also affected other browsers
stephen retweeted
"they did not feel their research was ready to publicly demonstrate"
And this kids is what happens when you can't come up with a catchy name for your vuln on time.
If anyone else wants to disclose whatsapp 0click, our team is always available to help: [email protected]
Check out POE2! Hardware support to build untrusted JIT!
More HW security goodness from Arm:
community.arm.com/arm-commun…
vMTE (Virtual Memory Tagging) allows to use MTE in a more flexible way, consuming less RAM.
POE2 allows to build efficient in-process sandboxes and isolation. More-or-less improvement over x86 Memory Protection Keys.
stephen retweeted
NEW: The U.S. govt accused Peter Williams, ex general manager of hacking tool maker L3Harris Trenchant, of stealing trade secrets and selling them to buyer in Russia.
Earlier this year Trenchant investigated a leak of internal tools. It's unclear if the investigation is related.
stephen retweeted
First mention of x86 memory tagging (aka MTE) by both Intel and AMD (codename ChkTag):
community.intel.com/t5/Blogs…
amd.com/en/blogs/2025/amd-an…
🤘🤘🤘
stephen retweeted
The call for next year's DEF CON CTF Organizers has opened. I have an idea of a new format which combines Jeopardy, A/D and LiveCTF, that I call "Battle-Royale." The new format should greatly reduce the team-size impact and at the same time make CTF more enjoyable
stephen retweeted
🔺iPhone models announced today include Memory Integrity Enforcement, the culmination of an unprecedented design and engineering effort that we believe represents the most significant upgrade to memory safety in the history of consumer operating systems. security.apple.com/blog/memo…
