Zhenpeng (Leo) Lin's banner

Zhenpeng (Leo) Lin

@Markak_ • 3,717 subscribers

AI x Security @depthfirstlabs, Ph.D., CTF player @Nu1L_team, now @StrawHat_CTF. #Pwn2Own winner. Author of #DirtyCred #Badiouring

Shorts

Our agent autonomously found this kernel 0day and its exploit works on the #KCTF target. We are building to find vulnerabilities systematically, not just shadow bugs. See the quoted post below—comment "depthfirst" and we'll send you a free agent to try out.

Our agent autonomously found this kernel 0day and its exploit works on the #KCTF target. We are building to find vulnerabilities systematically, not just shadow bugs. See the quoted post below—comment "depthfirst" and we'll send you a free agent to try out.

16,826 görüntüleme

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

Containers are no longer a security boundary. Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers. As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from depthfirst and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported. Read our full writeup:

Containers are no longer a security boundary. Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers. As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from depthfirst and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported. Read our full writeup:

Zhenpeng (Leo) Lin

88,048 görüntüleme • 1 gün önce

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in NGINX impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in NGINX impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at

Zhenpeng (Leo) Lin

211,874 görüntüleme • 4 ay önce

Open-sourcing our RCE implementation for CVE-2026-42533! This is an incredibly powerful NGINX bug that provides both info leak and an out-of-bounds heap write primitives (so, yes, ASLR bypass!). F5 released the security advisory a week ago on July 15th. Fun fact: this bug appears to have been found concurrently by multiple groups. Our team at depthfirst caught it using our internal systems, right alongside CVE-2026-42530, a separate issue in NGINX’s HTTP/3 QPACK implementation.

Open-sourcing our RCE implementation for CVE-2026-42533! This is an incredibly powerful NGINX bug that provides both info leak and an out-of-bounds heap write primitives (so, yes, ASLR bypass!). F5 released the security advisory a week ago on July 15th. Fun fact: this bug appears to have been found concurrently by multiple groups. Our team at depthfirst caught it using our internal systems, right alongside CVE-2026-42530, a separate issue in NGINX’s HTTP/3 QPACK implementation.

Zhenpeng (Leo) Lin

30,500 görüntüleme • 2 ay önce

Daha fazla içerik yok.