kmkz (@kmkz_security) header
kmkz (@kmkz_security) profile picture

kmkz

@kmkz_security

Bourbon Offensive Security Services | BOSS

 Troisvierges, Luxembourg
boffsec-services.com/
Joined October 2012
  • Tweets30K
  • Following1.8K
  • Followers19.9K
924Media
Photo by kmkz (@kmkz_security)Photo by kmkz (@kmkz_security)Photo by kmkz (@kmkz_security)Photo by kmkz (@kmkz_security)Photo by kmkz (@kmkz_security)Photo by kmkz (@kmkz_security)Photo by kmkz (@kmkz_security)Photo by kmkz (@kmkz_security)Photo by kmkz (@kmkz_security)Photo by kmkz (@kmkz_security)
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
Welcome to Hotel Calif, where Brotli might lead to memory corruption. But who would use wifi with a phone in lockdown mode 😜
Calif (@calif_io) profile pictureCalif
@calif_ioNov 10
Welcome to Hotel Calif. We're in lockdown mode. You can check in, but you can never leave. Broccoli is served around the clock. The Brotli bug apparently affected iOS and macOS too. Apple released version 27.2.1 yesterday, fixing this bug among other security issues. This is an important security update. If you haven't updated yet, now's a good time. The demos show what we were able to do with it.
4
10
147
12,941
kmkz retweeted
Samir (@SBousseaden) profile picture
Samir@SBousseaden13h
We're looking for a Senior Manager, Endpoint Protections at Elastic (100% remote): - deep endpoint OS internal knowledge - experience developing EDR capabilities - adversarial instinct - Bonus points for endpoint AI/ML experience jobs.elastic.co/jobs/enginee…
4
20
69
8,685
🔓 Breaking the Sandbox: PHP disable_functions Bypass via Use-After-Free (8.5.x / 8.4.x) Today, ZeroZenX disclosed a Use-After-Free vulnerability in PHP 8.5.x / 8.4.x that allows escaping disable_functions and achieving OS command execution. Our clients are already protected. Full technical writeup and PoC on GitHub 👇 github.com/zerozenxlabs/PHP-… #PHP #AppSec #VulnerabilityResearch #ZeroZenX #bugbounty #zeroday
Image from ZeroZenX (@zerozenxlabs)
1
22
2
99
8,974
Besides fuzzing, researchers also find vulnerabilities by serendipity, just by tinkering with systems. I found and documented one of those cases here: Accidentally Uncovering A Seven Years Old Vulnerability In The Linux Kernel
allelesecurity.com/vuln-tcp-… I also have a pending blog post about another vulnerability I found the same way. And those two cases aren't the only ones I have found by serendipity. Here is another case, by someone else: The code that wasn't there: Reading memory on an Android device by accident
github.blog/security/vulnera… Those who tinker with systems are the most likely to come across these issues. Playing directly and manually with them might still be worth it for several reasons: it's fun, it keeps you fresh, and it might lead to unexpected results that wouldn't be found through reasoning alone.
Accidentally uncovering a seven years old vulnerability in the Linux kernel

Accidentally uncovering a seven years old vulnerability in the Linux kernel

Para acessar esta postagem em português, clique aqui. Vulnerability research is at the core of Allele Security Intelligence. We have been actively researching for more than a decade, and we offer o…

allelesecurity.com
6
21
87
3,339
kmkz retweeted
0xor0ne (@0xor0ne) profile picture
0xor0ne
@0xor0neNov 10
Developing exploit primitives with cve-2025-20741 (heap overflow in vie_oper_proc()) blog.coffinsec.com/0day/2026… #infosec
kernel alchemy pt. 1: developing exploit primitives with CVE-2025-20741

kernel alchemy pt. 1: developing exploit primitives with CVE-2025-20741

Part 1 in a small series of posts covering the development of kernel exploit primitives, demonstrated with a few bugs in the Mediatek MT76xx wifi driver.

blog.coffinsec.com
29
188
7,694
Replying to @UK_Daniel_Card @HackingLZ
🔥🔥 – at Walferdange, Luxembourg
25
Hacking is now $0 github.com/rapid7/metasploit… exploit-db.com/
32
75
4
1,125
82,954
Verify it, close it, read it again? Bro,that's TOCTOU. EDR vendors :)) Reported it. Blog coming if accepted.
Image from DbgMan ^_^ (@0XDbgMan)
Image from DbgMan ^_^ (@0XDbgMan)
3
3
59
4,119
New exploits in the @VulnCheckAI Initial Access community repo: Atlassian Data Center unauth cred leak (CVE-2026-21589), GitLab unauth RCE (CVE-2026-97229), and a Collabora Online RCE used in ransomware attacks (CVE-2026-110447). Detections + queries, too: github.com/vulncheck-oss/ini…
GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

Initial Access Exploits and Associated Artifacts. Contribute to vulncheck-oss/initial-access-community development by creating an account on GitHub.

github.com
3
10
1
35
1,976
Replying to @mdisec
Interesting
474
kmkz retweeted
Docker (@Docker) profile picture
Docker
@DockerNov 9
Replying to @mdisec
We agree: Docker Sandboxes are not containers! Read more here: docker.com/products/docker-s…
Docker Sandboxes vs. Docker Containers | Docker

Docker Sandboxes vs. Docker Containers | Docker

A Docker container shares the kernel of the machine it runs on. A Docker Sandbox is a microVM with its own kernel and its own Docker daemon. A line-by-line comparison.

docker.com
4
14
1
114
23,135
The final part of our CVE-2023-20938 series: turning a Binder use-after-free into root on a Pixel 6 running Android 12. Root turns out to be anticlimactic: a few fields in one kernel struct, set to zero. 🔗 Read part 5: eshard.com/blog/kernel-uaf-5…
1
19
94
4,214
Image from American Firearms Association (@2A_Freedom)
107
1,168
53
3,974
25,775
kmkz retweeted
vortex (@vortexau) profile picture
vortex@vortexauNov 8
Repeat after me. Docker is not a security boundary. Once again, with feeling.. DOCKER IS NOT A SECURITY BOUNDARY!
Sufyan (@sfxnz) profile pictureSufyan
@sfxnzNov 7
Docker sandboxes is probably the single most important tool you can learn in the AI age.
68
85
15
1,574
104,801
Docker👏🏻is👏🏻NOT👏🏻a👏🏻sandbox👏🏻
Sufyan (@sfxnz) profile pictureSufyan
@sfxnzNov 7
Docker sandboxes is probably the single most important tool you can learn in the AI age.
97
44
15
2,039
194,880
Firecracker VM Escape: PwnEscape Part 2. pwn.ai/blog/firecracker-esca…
Firecracker VM Escape: PwnEscape Part 2.

Firecracker VM Escape: PwnEscape Part 2.

A malicious guest crossed Firecracker's microVM boundary, resolved the live VMM from inside the VM, and took control of a root-run host process—turning a Linux networking flaw into a guest-to-host...

pwn.ai
17
1
134
9,299
I wrote an article about browser's sandbox bugs davi-1337.github.io/posts/ca…
1
50
273
10,353
Writeup github.com/UnsignedChad/CVE-…
GitHub - UnsignedChad/CVE-2026-21155-SVE-2026-3546: Writeup CVE-2026-21155

GitHub - UnsignedChad/CVE-2026-21155-SVE-2026-3546: Writeup CVE-2026-21155

Writeup CVE-2026-21155. Contribute to UnsignedChad/CVE-2026-21155-SVE-2026-3546 development by creating an account on GitHub.

github.com
Charles (@unsignedbytes) profile pictureCharles
@unsignedbytesNov 4
Samsung. CVE-2026-21155
6
33
2
305
23,154
🚨During the past 24 hours, we have observed a small amount of actors targetting SSHole (CVE-2026-123158) Exploitation is not widespread yet, but is showing an early accelerating trend. Track exploit intelligence 👉console.defusedcyber.com/int…
Image from Defused (@DefusedCyber)
3
8
1
19
2,777
And yall are worried about agent swarms xitter.twitterapi.xyz/v12sec/status/21184420…
V12 (@v12sec) profile pictureV12
@v12secNov 5
Changing one letter bypassed an entire admin API in @huggingface chat. One request could trigger bulk internal exports of every user’s private chats, completely unauthenticated. Here’s how. 🧵
Image from V12 (@v12sec)
8
23
148
9,487
Load more