A Singapore company that discovers vulnerabilities to help customers mitigate the risks of cyber attacks. Organisers of @offbyoneconf
Singapore
Joined September 2018
- Tweets343
- Following14
- Followers10.5K
- Likes285
Full chain done 22 April. Submitted on the 7 May deadline. ZDI: sorry, we’re full.
KVM entries at Berlin 2026: nil.
Lesson: register EARLY. And AI makes easy bugs everyone’s now, so the edge is the deep stuff it can’t reach.
github.com/star-sg/Presentat…
Then root: a unix_gc race (CVE-2026-23394) + DirtyMode past kernel IBT, SELinux switched off.
Cross-tenant was the choice bit. Pagecache trick: coax /etc/passwd into cache, swap in our creds, log in. We didn’t knock. 🔑
• /proc/self/mem + ROP past seccomp & SHSTK, the latter being all mouth, no trousers (off in glibc by default) • CVE-2026-23394 unix_gc race + DirtyMode to root past kernel IBT
starlabs retweeted
Friends ask: “You’re a consultancy with no product, why STAR Labs?” Today’s my answer: 5 RCEs on Pixel 10 & 11, all patched by Google, from a team you could fit round 1 table. We don’t sell a box. We break the unbreakable and tell you how. 👇
Open invite to @Google, @Kimi_Moonshot, @OpenAI & @AnthropicAI : your compute, our vulnerability research. We can use your AI to find flagship-grade bugs faster. That’s a trade worth making.
Huge credit to every researcher on this team. We’re only getting started.
starlabs retweeted
📚 Slide decks from OB1 2025 & 2026 are live!
Catch up on talks you missed, revisit top sessions, or dive into the technical breakdowns. Most slides are up on GitHub:
👉🏻 github.com/star-sg/OBO
Huge thanks to all our speakers, sponsors, activity partners, and attendees!
Our intern Yap Yuan Xi pointed AI at Cisco Smart Software Manager and went to make tea. It found a post-auth RCE in under an hour
He spent days writing the report. Cisco had silently patched it the day after he found it. No CVE, not even a biscuit, at least not that we know of.
The 1st write-up is published simultaneously on @idnsecurity and our blog.
- starlabs.sg/blog/2026/09-how…
- starlabs.sg/blog/2026/09-dir…
🚨 We went looking at Cisco ISE and got a buffet spread.
CVE-2026-76423: unauth auth bypass, CVSS 10.0. Full admin, no login and many others. Patched.
9 CVEs for @CurseRed & Tevel Sho, part of ~30 we reported.
sec.cloudapps.cisco.com/secu…
sec.cloudapps.cisco.com/secu…
If @AnthropicAI @OpenAI and @Google got spare tokens and compute for us to secure the world. We are always ready and waiting. We are just 1 email away 😉
17 Apple CVEs. 15 in the 🍎 🌽 . All by 👀 by our team members
@Google @OpenAI @AnthropicAI , your models are already in this advisory. You bring the compute, we can bring you the bugs. 🤝
support.apple.com/en-us/1490…
On Android? Update now.
We’re holding technical details while the fix reaches users. The demo speaks for itself.
This is what we bring to client’s code too: the deep bugs an attacker would find, before one does. Taking on new audit engagements, fully confidential.
We are proud to share that @hi_im_d4rkn3ss has received the Bug of the Year award at the @thezdi Vanguard Awards.
The Awards were introduced by the ZDI to recognise outstanding contributions by security researchers & vendors that help strengthen the security ecosystem.
