Vulnerability research from discovery to disclosure.
Long-form dives into the vulnerabilities we've found, the tooling behind them, and the techniques we used to exploit them — alongside product and company updates.
Beyond the Model: Benchmarking Codex Security, Claude Security, and Nebu
IonStack part III: Rooting Android 17 with GhostLock
IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307
How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865
From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty
Research that
reaches production.
A continuously updated record of validated vulnerabilities discovered by NebuSec across open-source and commercial software.
1177+
validated vulnerabilities
12+
projects affected
Backed by Y Combinator.
Talk with our team about your codebase, infrastructure, and security priorities.
