2026.09.19Death Ops96 bytes of alphanumeric loader out of a seccomp jail, then a kernel LPE built on a char device that allows exactly two arbitrary writes.Pwn2026.09.19Freal World ManipulationAn IEEE754 overflow blows the index limit open, and the mincore() bounds check becomes the oracle that defeats 1 GB of brk randomisation.Pwn2026.09.19Gap Gapp-1 and q-1 share a 600-bit prime, which turns 30 redacted digits of d into a Coppersmith root modulo an unknown divisor of N-1.104ptCrypto2026.09.19peekabooseccomp allows 8-byte writes from one page only, so the ciphertext is found by mmap binary search and the 24-bit srand seed does the rest.Pwn2026.09.19pickleEvery string written as \uXXXX slips past a byte-level blocklist, and the check that should have stopped REDUCE throws inside its own try.Web2026.09.19yccThe sandbox flags are airtight; the bug is that emit_dot splices an unescaped key into the generated C, so a map lookup breaks out into system().Misc2026.09.19ZigerionsA VMProtect-packed dropper chain whose final payload is an unrunnable ELF carrying an AES key next to its own ciphertext.Reversing2026.09.19pwnsec-supportSQLi into a bespoke register VM, then a 4-byte arbitrary write turned into an arbitrary read by type-confusing a Lua table slot.142ptPwn2026.09.19PHaultIdentical responses and padded timing close every usual channel, so the oracle becomes PHP's memory_limit: a 34 MB row makes the page fatal.Web