--- title: "All research" description: "Every research post NebuSec has published, newest first." url: https://nebusec.ai/research/all/ --- # All research 10 articles October 21, 2026 · incident-response · 7 min read ## [Investigating the PingCAP Security Incident: Credential Exposure and Cloud Data Collection](https://nebusec.ai/research/pingcap-security-incident.md) Between September 9 and October 7, 2026, an unauthorized party used a compromised GitHub account and exposed cloud credentials to copy PingCAP source code and internal analytics, storage and support records. NebuSec led the independent investigation and found no evidence of command execution, persistence, or access to data in customer TiDB databases. This report covers the intrusion, the exposed data, containment, recommended actions and indicators of compromise. September 1, 2026 · benchmark · 5 min read ## [Beyond the Model: Benchmarking Codex Security, Claude Security, and Nebu](https://nebusec.ai/research/nebu-benchmark.md) We benchmark our pipeline against Codex Security and Claude Security. Our pipeline gives you a better trade-off: match competing scanners in a fraction of the time and cost, or scale up to find more bugs than either of them. August 27, 2026 · chrome · 10 min read ## [Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon](https://nebusec.ai/research/v8-turboshaft-wasm-phiop-cve-2026-7899.md) In April, we reported a severe vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome. This vulnerability enabled remote code execution in Chrome’s renderer process. This writeup will cover the technical details of the vulnerability. The research was performed with internal tool Mnemosyne, by Project WhatForLunch browser security team at NebuSec, led by @xia0o0o0o and @rcv August 8, 2026 · linux · 12 min read ## [Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF](https://nebusec.ai/research/cve-2026-43501-route-of-root.md) CVE-2023-2156 ("Route of Death") is a Linux kernel vulnerability that was believed to only lead to a DoS attack, and was considered patched in April 2023. However, NebuSec discovered a bypass of the patch and found that it is actually exploitable and can lead to LPE on any Linux distribution that has IPv6 and namespaces enabled. This writeup covers the technical details of the exploit. July 15, 2026 · Android · 12 min read ## [IonStack part III: Rooting Android 17 with GhostLock](https://nebusec.ai/research/ionstack-part-3.md) GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by NebuSec that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world’s first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android. July 10, 2026 · firefox · 14 min read ## [IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT](https://nebusec.ai/research/ionstack-part-1-cve-2026-10702.md) Despite Anthropic Mythos's extensive auditing of Firefox, our agent Nebu still managed to uncover IonBanana, a subtle SpiderMonkey IonMonkey just-in-time miscompilation that can be exploited to achieve arbitrary code execution in the Firefox content process. To our knowledge, this is the first SpiderMonkey JIT CVE after Firefox's last-minute pre-Pwn2Own update, which fixed a large batch of vulnerabilities. We also used it to pwn Tor Browser, showing that even after heavy auditing, JIT compilers still have plenty of places for a banana peel to hide. July 7, 2026 · linux · 17 min read ## [IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years](https://nebusec.ai/research/ionstack-part-2.md) GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebu that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit. June 29, 2026 · chrome · 19 min read ## [Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307](https://nebusec.ai/research/v8-cve-2026-6307-writeup.md) Chrome V8 JavaScript engine features a heap sandbox to prevent an attacker from writing outside of the sandbox region with only a vulnerability in their JavaScript engine. However, Nebu discovered a special bug in the JIT compiler that allows an attacker to gain arbitrary read/write primitives in sandbox and even escape the sandbox to write outside of it solely on its own. This writeup will cover the technical details of the vulnerability. May 7, 2026 · chrome · 15 min read ## [How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865](https://nebusec.ai/research/v8-maglev-incorrect-phis-untagging.md) In March, our system detected a severe vulnerability in V8, the JavaScript engine used by Chrome. This vulnerability enabled remote code execution against billions of Chrome users worldwide. April 14, 2026 · linux · 18 min read ## [From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty](https://nebusec.ai/research/cve-2026-23274-cos.md) Our AI security research pipeline discovered a critical vulnerability in Linux kernel. This post covers the discovery and exploitation of CVE-2026-23274, a Linux netfilter bug that led to kernelCTF code execution.