All research

10 articles

October 21, 2026incident-response7 min read

Investigating the PingCAP Security Incident: Credential Exposure and Cloud Data Collection

Between September 9 and October 7, 2026, an unauthorized party used a compromised GitHub account and exposed cloud credentials to copy PingCAP source code and internal analytics, storage and support records. NebuSec led the independent investigation and found no evidence of command execution, persistence, or access to data in customer TiDB databases. This report covers the intrusion, the exposed data, containment, recommended actions and indicators of compromise.

August 27, 2026chrome10 min read

Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon

In April, we reported a severe vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome. This vulnerability enabled remote code execution in Chrome’s renderer process. This writeup will cover the technical details of the vulnerability. The research was performed with internal tool Mnemosyne, by Project WhatForLunch browser security team at NebuSec, led by @xia0o0o0o and @rcv

August 8, 2026linux12 min read

Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF

CVE-2023-2156 ("Route of Death") is a Linux kernel vulnerability that was believed to only lead to a DoS attack, and was considered patched in April 2023. However, NebuSec discovered a bypass of the patch and found that it is actually exploitable and can lead to LPE on any Linux distribution that has IPv6 and namespaces enabled. This writeup covers the technical details of the exploit.

July 15, 2026Android12 min read

IonStack part III: Rooting Android 17 with GhostLock

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by NebuSec that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world’s first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.

July 10, 2026firefox14 min read

IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT

Despite Anthropic Mythos's extensive auditing of Firefox, our agent Nebu still managed to uncover IonBanana, a subtle SpiderMonkey IonMonkey just-in-time miscompilation that can be exploited to achieve arbitrary code execution in the Firefox content process. To our knowledge, this is the first SpiderMonkey JIT CVE after Firefox's last-minute pre-Pwn2Own update, which fixed a large batch of vulnerabilities. We also used it to pwn Tor Browser, showing that even after heavy auditing, JIT compilers still have plenty of places for a banana peel to hide.

July 7, 2026linux17 min read

IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebu that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit.

June 29, 2026chrome19 min read

Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307

Chrome V8 JavaScript engine features a heap sandbox to prevent an attacker from writing outside of the sandbox region with only a vulnerability in their JavaScript engine. However, Nebu discovered a special bug in the JIT compiler that allows an attacker to gain arbitrary read/write primitives in sandbox and even escape the sandbox to write outside of it solely on its own. This writeup will cover the technical details of the vulnerability.