Security Researcher at @vcslab | CTF player (pwn) of @u0Kplusplus
Hanoi, Vietnam
Joined June 2013
- Tweets474
- Following1.2K
- Followers948
- Likes4.2K
Hai Tung retweeted
Just dropped a new blog post! 🔥
blog.orange.tw/posts/2026-10…
Hai Tung retweeted
Nice work - The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only! blog.orange.tw/posts/2026-10…
Hai Tung retweeted
Just published a reference of every kernel structure, routine, and MSR monitored by PatchGuard (KPP) on Windows.
Some ones may be missing, so PRs are welcome!
github.com/S12cybersecurity/…
Hai Tung retweeted
I found a new RCE bug in PHP, missed by previous auditing teams. It’s unpatched in PHP v8.5.12
Hai Tung retweeted
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
Hai Tung retweeted
The story behind the chrome full chain bonus,
we thought that we could get it using 1-day renderer exploit that I had + 0-day sbx that he found, but we got a reply that all the bugs used in the chain must be 0-days.
As I was working on an exploit of a different target, I couldn't spare any time for his work.
After a few days, I heard that he got a 0-day exploitable v8 bug from nebusec, so I was like "wtf, really?".
So, I joined him in finding v8 heap sandbox bug after finishing my work.
Then we've managed to find a non-duplicate v8 heap sandbox bug after 2,3 days, fuzzing and spending tokens all night.
Huge congrats to him for believing it was possible and putting in the work to make it happen.
We just received a $250,000 Chrome Full Chain bonus! 🎉
We've claimed the second Full Chain bonus of 2026. Only two remain!
Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched.
Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research.
P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!
Hai Tung retweeted
To leverage AI agents for vulnerability research, we built a hybrid source-code analysis workflow that combines deterministic analysis with agentic reasoning. Applied to FreeRDP, it helped us uncover vulnerabilities and chain them into client-side RCE.
blog.quarkslab.com/from-ai-a…
Hai Tung retweeted
$300,000!!!!! and 30 Master of Pwn points officially makes Ikotas Labs, Inc. the Master of Pwn as they jump to the top of the leader board after they chained multiple issues together to successfully exploit the Google Pixel 10 #Pwn2Own
Hai Tung retweeted
Success!! Tim Becker (@tjbecker) and Yves Bieri (@yves_bieri) of Xint (@xint_official) just remotely exploited the targeting Google Pixel 10! Stay tuned for confirmation if they will secure the total of $300,000 and 30 Master of Pwn points!
Hai Tung retweeted
If you're into Windows internals, kernel development or reverse engineering, bookmark this.
@codemachineinc has an incredible FREE archive of low-level Windows research covering:
• WinDbg + kernel debugging
• Windows kernel data structures
• Kernel callbacks
• NTOSKRNL internals
• EX_FAST_REF pointers
• TEB internals
• Prototype PTEs
• x64 kernel virtual address space
• System call internals
• Windows on ARM
• Interrupt dispatching
• KMDF internals
• WFP + WSK + AFD
• Kernel threads
• Physical memory analysis
• Driver development + debugging
There are also some absolute gems like using WinDbg to analyze/remove Poison Ivy RAT and a full catalog of key Windows kernel structures.
A lot of the material is older, but the fundamentals are still extremely valuable for understanding Windows under the hood.
Full FREE article archive:
codemachine.com/articles.htm…
Huge credit to @codemachineinc for keeping this material publicly available.
#WindowsInternals #ReverseEngineering #KernelDevelopment
Hai Tung retweeted
🍎🐛 I got Claude making this, maybe it's useful for others as well.
Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations.
apple-cve.com/
Hai Tung retweeted
Exploiting Reversing (ER) Series | Article 10: iOS Security Research (part 01)
223 pages, free. The first article in the series aimed at iOS itself, and the opening of a multi-part sequence.
Published on:
blackstormsecurity.com/resea…
This article will be published on exploitreversing.com/ next week.
I would like to thank Ilfak Guilfanov (@ilfak) and Hex-Rays SA (@HexRaysSA) for the continuous support.
Hope you enjoy the read!
#iOS #Apple #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering
Hai Tung retweeted
The TL;DR of what Anthropic just said:
1.) GLM-5.3 is as good as Mythos for exploit development.
2.) Unlike Claude, GLM-5.3 gives you the results you pay for.
3.) Governments should ban AI models which are as good as theirs but are not made by them.
The funniest part is how Anthropic admitted self-reflectively that the lack of guardrails may actually be benefiting the defenders working to secure their systems. 🤪
Something they never wanted to allow, because of possible misuse.
I don't get it, but I feel Anthropic should at least put a note at the very bottom if they are doing paid advertising to promote GLM-5.3. 😜
Source:
anthropic.com/research/glm-5…
