Going from IOPL escalation to root. Learn how here: kqx.io/post/fw_cfg/

Reviving CVE-2023-0597 with QEMU. Find out more at kqx.io/post/sp0/

had a lot of fun playing corctf this weekend. Ended up at 4th place with TRX and also managed to first-blood the uarch challenge authored by FizzBuzz101. You can find the writeup at kqx.io/writeups/zener…

Will you be able to exploit a 13-year-old vulnerability on QEMU'S TCG and become root? kqx.io/attachments/qe… Hit us up in dm if you make progress!

If you're interested in exploiting JS engines check out what we faced in Romania at DefCamp finals 2025: kqx.io/writeups/inlin…

had fun playing Backdoor CTF 2025, ended up fifth with TRX and first-blooded a kernel pwn challenge. Have a look at the writeup: kqx.io/writeups/vibe_…

Let's begin the new year with some V8 exploitation! Learn how to turn a broken CanonicalEquality check into arbitrary Wasm type confusion in this ASIS CTF Finals writeup by @Erge! Read it here: kqx.io/writeups/singl…

We decided to create a new account on X to consolidate all information in one place. Follow the account to be updated on the blog! kqx

RCE in firefox is crazy!! erge really cooked with this one...

Hunting Linux kernel 0day with Frank Wu 5 days, from zero to stable privilege escalation. sha256: 2189d5b196f33d512d8d02c6f00d26f4c10bf79ba1f0ac389d6663e026aebbe8