Behnam @bdsecure

vulnerability researcher | full-time learner ninjas.zip Vienna, Austria Joined June 2017

Tweets

885
Followers

839
Following

5K
Likes

4K

V4bel @v4bel

5 days ago

🚨 Introducing "ITScape" (CVE-2026-46316) A Guest-to-Host Escape in KVM/arm64. Guest-side actions alone exploit a use-after-free to run root-privileged code in the host kernel. Unlike the commonly published QEMU escapes, the bug lives in in-kernel KVM, not QEMU. On a successful exploit, commands run with host kernel privilege rather than the privilege of a user process, threatening the guest-host isolation of multi-tenant arm64 public clouds. To the best of public knowledge, the first Guest-to-Host Escape Exploit targeting in-kernel KVM/arm64. Details: itscape.io

4 91 296 26K 133

View Details

offensivecon @offensive_con

2 weeks ago

Offensivecon's talks are now available on our YouTube channel! 🔗 buff.ly/g63xgm5

1 100 341 25K 149

View Details

itszn @itszn13

2 weeks ago

Chrome’s JavaScript engine V8 is getting harder and harder to find bugs in.. But powerful models still find a way! Yesterday’s Chrome release fixed CVE-2026-9973; A JIT loop optimization bug we found using gpt-5.5 in Codex. It had been around for over 2 years…

5 41 410 26K 127

View Details

International Cyber Digest @IntCyberDigest

3 weeks ago

‼️ After the MSRC blog post about Nightmare-Eclipse, researchers are coming forward with their own MSRC horror stories. The response from the security community isn't going Microsoft's way. As they’re not backing Microsoft. Gabriel Landau, a well-known Windows security researcher, says he reported a Device Guard bypass with a 90-day window. MSRC told him it met their bar and they'd fix it, then asked him to hold disclosure for extra months. He agreed on the condition they issue a CVE. They patched it silently, decided after the fact it "didn't meet the bar," and never issued the CVE. In his words: "MSRC strung me along for a few extra months to keep me quiet, then broke their word." Another researcher, rootsecdev, says he responsibly disclosed a legacy-auth flaw that allowed password spraying while avoiding smart lockout. Five months later, MSRC replied that it "doesn't meet the bar for servicing," silently fixed it, and closed the case. Microsoft's post was meant to defend their coordinated disclosure policy. Instead it became a thread of researchers explaining why they've stopped trusting their process.

International Cyber Digest @IntCyberDigest

3 weeks ago

‼️ Microsoft has responded to the recent wave of public zero-day disclosures tied to Nightmare-Eclipse. In an MSRC post titled "A shared responsibility," Microsoft addressed RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma, saying the vulnerability details

33 81 710 115K 191

21 260 1K 90K 275

View Details

CERT Polska @CERT_Polska_en

3 weeks ago

Fuzzing has long been one of the most effective methods for finding vulnerabilities. But what happens when an LLM takes the wheel? Our latest research explores autonomous, AI-driven fuzzing and what it means for the future of security testing. 👇 cert.pl/en/posts/2026/…

1 52 207 50K 239

View Details

offensivecon @offensive_con

4 weeks ago

The conference ticket shop for Offensivecon Tokyo is open! Not many tickets left... 🔗 buff.ly/lSsGVHU

0 10 53 5K 8

View Details

TrendAI Zero Day Initiative @thezdi

a month ago

Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

29 183 2K 269K 144

View Details

Behnam @bdsecure

4 weeks ago

@ga1ois 🥲

0 0 0 735 0

View Details

Tao Yan @ga1ois

a month ago

[2]After our failed competition, we headed to Apple Store and bought the mbp m5 and spent less than half an hour to set it up and found a fixed offset is changed 1 bit on it, so we just change 1 bit on our exp and it worked with a 100% success rate. Yes just 1 bit change, 1 to 2.

TrendAI Zero Day Initiative @thezdi

a month ago

Unfortunately, Tao Yan & Edouard Bochin of Palo Alto Networks could not get their exploit of Apple Safari – Renderer Only working within the time allotted. #Pwn2Own #P2OBerlin

1 0 42 78K 7

14 38 569 104K 139

View Details

Behnam @bdsecure

4 weeks ago

@thezdi ❤️🥇🔥

0 0 1 554 0

View Details

TrendAI Zero Day Initiative @thezdi

4 weeks ago

That's a wrap on Pwn2Own Berlin 2026! 🏆 $1,298,250 awarded. 47 unique 0-days. 3 days of absolute chaos. And talk about main character energy - congrats to DEVCORE for claiming Master of Pwn with 50.5 points and $505,000 - they never slowed down. See you next year! #Pwn2Own #P2OBerlin

21 96 685 82K 54

View Details

offensivecon @offensive_con

4 weeks ago

Offensivecon is coming to Tokyo! 🔗 offensivecon.jp Ticket shop, sponsorships and CFP are already open...

7 88 297 38K 91

View Details

TrendAI Zero Day Initiative @thezdi

4 weeks ago

Mind blown alert 🤯! Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG (@starlabs_sg) used a Memory Corruption bug to exploit VMware ESXi with the Cross-tenant Code Execution add-on, earning a sweeeeeet $200,000 and 20 Master of Pwn points. Full win let's go! #Pwn2Own #P2OBerlin

5 59 544 48K 77

View Details

TrendAI Zero Day Initiative @thezdi

4 weeks ago

TRIPLE YAAAAAAAAAAA! That's 3 for 3 - what a legend 👑 Sina Kheirkhah (@SinSinology) of Summoning Team was able to exploit Red Hat Enterprise Linux for Workstations! Time for the disclosure room to dish the deets. #Pwn2Own #P2OBerlin

0 5 76 43K 7

View Details

T. @trendytofu

a month ago

We are hiring for vulnerability researchers! If you are at @offensive_con, let’s chat! trendmicro.wd3.myworkdayjobs.com/en-US/External…

2 18 63 8K 31

View Details

TrendAI Zero Day Initiative @thezdi

a month ago

There it is! Orange Tsai (@orange_8361) of DEVCORE Research Team was able to exploit Microsoft Exchange! If confirmed, they win a whooping $200,000 and 20 Master of Pwn points. Off to the disclosure room to explain how they did it and seal the deal. #Pwn2Own #P2OBerlin

16 63 528 67K 48

View Details

chompie @chompie1337

a month ago

Claude helped me with this bug too but in a different way... Tried to gaslight me saying it wasn’t ~exploitable in practice~ and I got obsessed with proving it wrong 😩

TrendAI Zero Day Initiative @thezdi

a month ago

Confirmed! @chompie1337 of IBM X-Force Offensive Research (XOR) used a race condition to escalate privileges on Red Hat Enterprise Linux for Workstations, earning $20,000 and 2 Master of Pwn points. #Pwn2Own #P2OBerlin

12 45 629 107K 86

42 100 1K 79K 140

View Details

Orange Tsai 🍊 @orange_8361

a month ago

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

TrendAI Zero Day Initiative @thezdi

a month ago

Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

31 161 1K 225K 149

112 366 3K 212K 362

View Details

International Cyber Digest @IntCyberDigest

a month ago

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots. Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy. ▪️ AI surfaces a massive wave of 0-day RCEs. ▪️ Submissions overwhelm ZDI past max capacity. ▪️ Slots run out. Researchers with working chains get rejected. ▪️ "Revenge disclosures" begin. ← we are here. Confirmed casualties so far: ▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land. ▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla. ▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere. ▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel. ▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected. ▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected. Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in. ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.

31 379 2K 414K 641

View Details

Wiz @wiz_io

a month ago

The secret's out.🤫 Introducing THE ZERODAY.CLOUD COMMUNITY 👾 Inside: • 0-day vuln deep dives from @xint_official, @stdoutput, @pspaul95 & more... • Access to events & a network of world-class hackers • CTFs with prizes Join now :)