2026.09.19big-winA loop that exits on != and can increment twice per pass never terminates, and its own counter is reachable through the array it bounds.Pwn2026.09.19huge binary 1An unchecked stack index leaks libc and printf is called twice, so one GOT overwrite turns the second call into system("/bin/sh").Pwn2026.09.19huge binary 2One byte of leak per run, so the first job is a loop: a single %hhn on a page-aligned libc address makes main call itself forever.Pwn2026.09.19make-a-wishA signed modulo on the array index makes free() take a stack pointer, and tcache never checks that a chunk lives on the heap.500ptPwn2026.09.19ihyhfclose() without NULLing the global FILE * lets a 464-byte note become the FILE struct, turning fflush into write(2) and fwrite into system().500ptPwn2026.09.19not-jsonTwo loops sharing one buffer compose: the key loop's overflow breaks the canary and the description loop's terminator repairs it, then one byte of saved RBP pivots the frame.500ptPwn2026.09.19prime calcDownloading and re-uploading a DMTCP checkpoint is a memory read/write primitive; one 36-byte path swap makes the worker read /flag instead of its config.Misc2026.09.19spotThe commitment is counted with FIONREAD but never read until after the reveal, and splice() puts a page reference in the pipe rather than bytes.Misc2026.09.19wafThe anti-ROP memset zeroes everything after the first NUL — and since we choose both the NUL position and the length, it becomes the tool that writes the chain.Pwn2026.09.19java notescommons-collections 3.2.1 on the classpath and an unfiltered readObject(), so CC6 gives blind RCE exfiltrated with curl's --data-binary.Pwn