Security research from discovery to disclosure.
Long-form dives into the vulnerabilities we've found, the tooling behind them, and the techniques we used to exploit them — alongside product and company updates.
Subscribe
Beyond the Model: Benchmarking Codex Security, Claude Security, and Nebu
Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon
Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF
IonStack part III: Rooting Android 17 with GhostLock
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307
How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865
From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty
Backed by Y Combinator.
Talk with our team about your codebase, infrastructure, and security priorities.
