New Project Zero blog post in which I dissect Apple DER-encoded entitlements and tell a story about how I found a fun (albeit short-lived) bug in the way they were decoded. googleprojectzero.blogspot.com/2023/01/der-en…

Blog post #2 is now live! Who knew that null-derefs might still be an exploitable bug class in Linux kernel? 😲 googleprojectzero.blogspot.com/2023/01/exploi…

I would love to share with you all my write-up and PoC on CVE-2022-42864, a TOCTOU in IOHIDFamily: muirey03.blogspot.com/2023/01/cve-20… I hope you enjoy!

Everyone knows that a firewall is meant to provide network security. However, what happens if that appliance has vulnerabilities on your external perimeter? Here’s 5 firewall and VPN exploit research from the past:

Helo Apple I can haz IOSurfaceAccelerator bug pls?

It’s time to tell you more: jhftss.github.io/CVE-2023-23525…

Tommaso (@[email protected]) gist.github.com/Proteas/2d8ea0…

New blog post here: CVE-2022-32902: Patch One Issue and Introduce Two jhftss.github.io/CVE-2022-32902…

If you want to do deep research on `SPTM`, this should be helpful. proteas.github.io/ios/2023/06/09…

😅 github.com/apple-oss-dist…

github.com/Proteas/a7-sep…

slides “Write a SEP app for iOS” github.com/pattern-f/pres…

New blog post is up which looks at an unpatched vulnerability in macOS which allows us to hijack entitlements from signed binaries.. aka.. DirtyNIB. blog.xpnsec.com/dirtynib/

I encountered the same issue as this Mac user, and I noticed that the green line doesn't appear when the screen is completely black. This is definitely a hardware problem. I'm wondering if anyone knows how to hack it from a low-level driver perspective to improve this situation？

Slides of my offensivecon talk are available: synacktiv.com/sites/default/…

C’mon Apple, iOS kernel vulnerability is not eligible for bounty? What would then be? It could have been ended up in Donncha Ó Cearbhaill or John Scott-Railton blogs. 🤦‍♂️

Meysam Donncha Ó Cearbhaill John Scott-Railton The house always wins

POC: github.com/wangtielei/POC…

MSRC fixed a RCE bug in TCPIP module. I found the bug several months ago. Its score is 9.8 and exploitation is more likely. Please apply the patch immediately.

didn't expect freebsd kernel vulnerabilities to be one of the favorite targets for researchers to withhold