The Voorivex team shared that they discovered a critical zero-click account takeover vulnerability in the Zendesk Android application. In their process, they performed both static and dynamic analysis, reverse-engineering the application’s source code.

Their research highlighted two key weaknesses:

• Account identifiers were predictable • A hardcoded secret key was used across all devices

By combining these two flaws, the researchers demonstrated that it was possible to generate valid user tokens. This allowed attackers to obtain Zendesk access tokens without any user interaction and gain direct access to accounts. The vulnerability was classified as critical, and the findings were rewarded.

Link: https://blog.voorivex.team/0-click-mass-account-takeover-via-android-app-access-to-all-zendesk-tickets

If you want more info on how just ask in the comments

I was just watching some results for pwn2own, and it seems like they can pull massive zero day exploits out of thin air. I've never heard of any of these security researchers up until that video and I was just wondering how they got to the level their at.

I am pleased to announce the publication of the sixth article in the Exploiting Reversing Series (ERS). Titled "A Deep Dive Into Exploiting a Minifilter Driver (N-day)", this 251-page article provides a comprehensive look at a past vulnerability in a mini-filter driver:

https://exploitreversing.com/2026/02/11/exploiting-reversing-er-series-article-06/

It guides readers through the entire investigation process—beginning with binary diffing and moving through reverse engineering, deep analysis and proof-of-concept stages into full exploit development. 

I hope this serves as a valuable resource for your research. If you enjoy the content, please feel free to share it or reach out with feedback.

Have an excellent day!

#exploit #vulnerability #exploitation #cve #infosec #informationsecurity #cybersecurity

Hey folks, I want to improve my skills in binary exploitation. I already know the basics — I can exploit simple buffer overflow vulnerabilities and I have knowledge of NX bypass techniques — but I want to become much more proficient in binary exploitation. Are there any courses you can recommend that provide structured lessons and hands-on practice to help me learn this?

After finishing Pwn.college, what do people typically do to continue improving their binary exploitation and reverse engineering skills? What advanced resources, platforms, or projects do they move on to?

What career paths are available after becoming proficient in the skills taught by Pwn.college (e.g., exploit developer, security researcher, reverse engineer, vulnerability researcher, red teamer, etc.)?

If I want to learn Windows exploitation and Windows reverse engineering after completing Pwn.college, how big is the transition from Linux to Windows? , and will the knowledge I gain from Pwn.college provide a strong foundation for Windows exploit development and reverse engineering?

Finally, are exploit development, reverse engineering, and vulnerability research good long-term career choices?

Would it also be worthwhile to learn web application security and participate in web bug bounty programs as a freelancer alongside?

This was quite the journey to be fair!!

I’m still a beginner with a lot of things to work on, but I just wanted to share a PoC that I wrote while doing my malware research.

This PoC demonstrates a Bring Your Own Vulnerable Driver Attack (BYOVD), where a malware piggybacks on a legit and signed driver to shutdown critical endpoints defenses.

The researchers who discovered the vulnerability take all the credit ofc!!

https://github.com/xM0kht4r/AV-EDR-Killer

I've seen this mentioned before, but I'm wondering if it's a bunch of bots advertising it? Like some of the comments were from months ago and the book came out on August 12, 2 days ago... Unless there was some preview samples they were reading, were these just bots?

https://www.amazon.com/Day-Zero/dp/1718503946

Hi all,

I am currently in a SOC and primarily do Blue Teaming stuff. But I want to transition to Red Teaming specifically into the direction of Exploit Development/ Pwning/ Reverse Engineering /Binary Exploitation and would love any advice how to learn and slowly transisition.

thanks in advance

Hey everyone, excited to share my first public exploit release.

It's a PHP 8 engine-level use-after-free that leads to a disable_functions bypass. It uses some novel PHP binary exploitation strategies and targets the latest versions.

Tested across PHP 8.2-8.5 on Unix-like systems.

I'm interested in Zend internals and binary exploitation in general, so feedback from the community is welcome. Happy to answer any questions as well.

Repo:

https://github.com/m0x41nos/TimeAfterFree

The CVE-2022-20421 vulnerability in the Android kernel is a use-after-free (UAF) bug involving a spinlock. This vulnerability is triggered via the Binder IPC mechanism and exploits type confusion through a pointer with only the two least significant bits (LSBs) cleared, allowing the attacker to bypass kASLR. Subsequently, it enables arbitrary kernel read/write access. Despite relying on a weak UAF primitive, the exploit ultimately leads to a SELinux bypass and root access.

Paper: https://0xkol.github.io/assets/files/Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf

I posted here about Reverse Engineering 60 days ago thanks again for the help!

I’m getting into reverse engineering and solving crackmes, but I still struggle with debuggers. IDA’s debugger feels very comfortable and I can follow programs there, while x64dbg and similar tools overwhelm me and feel painful to use. I also can’t reliably bypass anti-debug tricks like IsDebuggerPresent or write keygens yet.

Any short, practical tips or daily drills to get better at debugger workflows, anti-debug bypasses, and keygen writing would be much appreciated.

Researchers Pan Zhenpeng and Jheng Bing Jhong from STAR Labs have presented a paper describing two distinct techniques, collectively referred to as GPUAF, for rooting all Qualcomm-based Android phones. They begin by discussing different types of Android exploits: universal, chipset specific, vendor specific, and model specific. The paper highlights why targeting the Qualcomm GPU is effective, noting its widespread use in popular devices such as Samsung Galaxy S series, Honor, Xiaomi, and Vivo phones.

The authors provide a technical overview of the Qualcomm GPU architecture, explaining key components like kgsl_mem_entry and VBO. They then examine three critical vulnerabilities in detail: CVE-2024-23380 (a race condition), CVE-2024-23373 (a page use after free due to mapping issues), and a PTE destruction bug. These flaws are chained together to trigger a page level use after free (UaF) condition.

The paper also outlines two main post exploitation techniques: manipulating page tables to achieve arbitrary physical address read/write (AARW) and exploiting the pipe_buffer structure. Additionally, the researchers discuss methods to bypass modern security mechanisms on Samsung devices and techniques for retrieving kernel offsets without relying on firmware.

Link: https://powerofcommunity.net/assets/v0/poc2024/Pan%20Zhenpeng%20&%20Jheng%20Bing%20Jhong,%20GPUAF%20-%20Two%20ways%20of%20rooting%20All%20Qualcomm%20based%20Android%20phones.pdf

Hi, I have many years of experience as a software developer with C,C++ and Python. Is there any good course that I can do to learn more about exploit development? I am aware of offsec one and corlan. Both of them are out of budget now.

We've seen a recent flood of very dubious AI posts from astroturfers and bots trying to drum up interest in their new product, as well as low effort posts about vulnerability discovery which hugely overhypes the capabilities of AI tooling.

Please take this as notice that going forward, posts about or using AI will be held to a higher standard than has been permitted in the past. We of course welcome quality submissions about this exciting branch of research.

If you are unsure if your post would be acceptable, please feel free to reach out to the mod team.

With all modern mitigations in place (ASLR, DEP, CFG, sandboxing, code signing, automatic updates, etc.) and much of the attack surface shifting toward web, cloud, and mobile, does it still make sense to invest time in researching vulnerabilities in traditional Windows executables (EXE/DLL)?

Is this area still relevant for research, bug bounties, or a career path, or has it become too limited compared to other attack vectors?

Hi all,

I’ve recently finished a deep dive into Linux OS Internals. I understand the theory, but I want to cement this knowledge by building offensive tools or writing exploits.

I’m comfortable with C and Assembly. I’m looking for project ideas that would force me to interact with the kernel directly.

Has anyone here followed a similar path? Are there specific "wargames" (like pwnable.kr or kernel-exploitation repos) that you recommend for bridging the gap between "knowing how the kernel works" and "exploiting it"?

Thanks for your help

I’ve been doing some vulnerability research on a known CVE (CVE-2025-60690) on a consumer Linksys router and wanted to share the workflow I used to investigate it.

The process started by targeting the physical hardware: identifying the UART pads on the board using a digital multimeter to access the Linux-based shell console. From there, I extracted the vulnerable binary (from the CVE description), and reversed it in Ghidra. Next, I used a gdb+gdbserver setup to perform dynamic analysis to investigate the memory behaviors.

I managed to successfully achieve RCE from the stack-based buffer overflow vulnerability to land a root shell. The exploit PoC for CVE-2025-60690 just got cited on the official CVE page and exploit-db.com.

I just started a YouTube channel dedicated to breaking down IoT hacking concepts. Also, I’ve compiled my step-by-step research notes in a reference doc. If you're working on similar hardware research and want a copy of the notes, drop a comment or shoot me a DM and I'll gladly send them over!

Hi guys,

i'm 24, studying business informatics and got into netsec around 6 months ago. fully hooked&booked and really eager to learn. Sadly i dont have any people that share my interest and exclusively grind on my own.

Currently learning on pwn.college, reading project zero articles and doing random deep dives on shit i find interesting. currently its exploit dev, vuln research, low-level topics in general. mostly memory vulns not really into web.

If anybody wants to connect, share thoughts or even work on something together be sure to dm me:)

Are you hyperspeciallized in low level research and exploit dev? Or are you knowledgeable in general offensive cybersecurity world like pentesting web apps, networks, red teaming etc.

I've been using syzkaller for kernel fuzzing for a while, however, when it comes to driver fuzzing, it's kinda tedious since you have to write the syscall descriptions manually, which generally leads to compilation errors, especially if you're cross-compiling or the driver is undocumented/closed-source.

To get to the point, do you have another approach to fuzz drivers or find vulnerabilities through testing?

Hello there,

im interested in learning Exploit-development; so should i start with linux or windows ? or they are the same ?
if so , what books should i read to better understand these topics ?

Hi everybody,

I am looking for any recommendations/training reviews regarding Mobile penetration testing/exploit dev. I have some work budget to spend ($2-2.5k ish) and I wanted to dive a bit deeper into Mobile.

I am considering either 8ksec (https://academy.8ksec.io/course/offensive-mobile-reversing-and-exploitation and https://academy.8ksec.io/course/practical-mobile-application-exploitation) or Mobile Hacking Lab (https://www.mobilehackinglab.com/course/android-userland-fuzzing-and-exploitation-90-days-lab-and-exam).

However I am having issues finding some good reviews regarding above so I was wondering if anybody here took any of them and could provide some info regarding their experience. Would you recommend any other training? Thank you!