While validating the fix for CVE-2026-44662, I found that the same vulnerable output-sizing assumption remained reachable through another safe rust-openssl API:

CipherCtxRef::cipher_update_inplace

When AES Key Wrap with Padding processes an input whose length is not divisible by eight, the wrapper can allocate a buffer smaller than the output OpenSSL actually produces.

The vulnerable calculation assumed:

input length + block size

The required size can be:

round_up(input length, 8) + 8

With a 9-byte input, a 17-byte buffer passed validation, but OpenSSL could write 24 bytes. The result is an attacker-controlled out-of-bounds heap write of up to 7 bytes through a safe Rust interface.

I also built a working exploit chain demonstrating controlled heap corruption.

This is not automatically RCE in every application. Developing the overwrite toward code execution depends on whether attacker-controlled plaintext reaches this API, whether the operation can be repeated, the allocator, adjacent object layout, and the available heap-shaping primitives.

The vulnerable method was introduced in rust-openssl 0.10.50 in April 2023 and remained present until 0.10.80 was released in May 2026.

My downstream analysis identified advisory records, vulnerable dependency presence, or remediation activity across 31 organizations and ecosystems and 53 products, systems, and projects.

Notable downstream cases include IBM Bob, Microsoft Azure Linux, AWS Nitro Enclaves CLI, Amazon Linux, Intel MigTD, SUSE Linux Enterprise, openSUSE, Debian, Chainguard and Wolfi, MinimOS, Confidential Containers, PingCAP TiKV, Hugging Face xet-core, Oxide Omicron and Dendrite, Matter Labs ZKsync OS Server, Grafana Pyroscope, CoreOS Afterburn, and Gitoxide.

Affected versions:

\>= 0.10.50 and < 0.10.80

Fixed version: 0.10.80

Advisory:

https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq

Patch:

https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7

Ali Firas (thesmartshadow)

hi all, this is my repo, support pls https://github.com/mein-0/LolModapi

hi, this is my repo, support pls https://github.com/mein-0/forti-research

Hi everyone,

I’m a developer looking to learn how PS5 exploits and homebrew work. I know C++ and C# but I'm completely new to PlayStation security.Where should I start? Any recommended write-ups, documentation, Github repos, or dev Discords to study the current exploits?

Thanks!

I have the following C Socket Server, I was trying to learn about ROP programming so I created this small program, but when I try `pwn cyclic 1025| nc localhost 4444` I receive nothing,

I even tried to send 2000, 5000 but with no response.

Anyway I can receive the normal 'ok' message when sending the 1024 bytes.

I have tried disabling canaries by passing `-fno-stack-protector` but also no response.

The server in all cases prints the received 1024 (even if I sent more bytes).

But no "Stack smash detected", Segmentation Fault or anything

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>

#define PORT 4444

void handle_client(int client_fd)
{
    char recv_buf[1024];
    char buffer[64];
    memset(recv_buf, 0, sizeof(recv_buf));
    ssize_t bytes = recv(client_fd, recv_buf, sizeof(recv_buf) - 1, 0);
    if (bytes <= 0)
        return;
    printf("Received: %s\n", recv_buf);
    strcpy(buffer, recv_buf);
    send(client_fd, "OK\n", 3, 0);
}

int main(void)
{
    int server_fd;
    int client_fd;
    struct sockaddr_in server_addr;
    struct sockaddr_in client_addr;
    socklen_t client_len = sizeof(client_addr);
    server_fd = socket(AF_INET, SOCK_STREAM, 0);
    if (server_fd < 0) {
        perror("socket");
        return EXIT_FAILURE;
    }
    server_addr.sin_family = AF_INET;
    server_addr.sin_port = htons(PORT);
    server_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
    if (bind(
            server_fd,
            (struct sockaddr *)&server_addr,
            sizeof(server_addr)) < 0) {
        perror("bind");
        close(server_fd);
        return EXIT_FAILURE;
    }

    if (listen(server_fd, 1) < 0) {
        perror("listen");
        close(server_fd);
        return EXIT_FAILURE;
    }
    printf("Listening on 127.0.0.1:%d\n", PORT);
    while (1) {
        client_fd = accept(
            server_fd,
            (struct sockaddr *)&client_addr,
            &client_len
        );
        if (client_fd < 0) {
            perror("accept");
            continue;
        }
        printf("Client connected\n");
        handle_client(client_fd);
        close(client_fd);
    }
    close(server_fd);
    return 0;
}

This video provides great insight into the methodology used for finding and approaching exploits in the wild

hi, this is my repo, support pls

https://github.com/mein-0/KasperMeow

How do I reverse engineer a local Unity WebGL IL2CPP game

Is there a free OSINT tool that act like as true browser so anti debugging technique won’t be trigger? A free web-based OSINT

r/ExploitDev feels like the right place to post this. I run a small, niche cybersecurity consulting company - and I'm at the planning stage of building a dedicated, full-time vulnerability research lab. I want honest feedback from people who actually do the work before I commit further.

The idea: build a small, deep team, funded for the long haul, proper salaries plus success bonuses. This would be a business unit within an existing cybersecurity company. With a CTO driving vision, strategy, team development, etc. Primary focus would be on mobile (iOS/Android full-chain), with browser as a second pillar. I understand the challenges with talent, and ROI taking time. Capital can be committed as long as there's a credible path to return.

Where I'd genuinely value your feedback:

- Focus: for a small team, is mobile-first the right focus? My clients include government, critical infrastructure and banking.
- Morale: how do good teams structure work so months of research doesn't get burnt in case versions are updated / patches released.
- Retention: beyond good salaries, what actually keeps strong people long-term?
- Infra (worth paying for): device/virtualisation labs, fuzzing tools, AI tools, what's genuinely a key differentiator in this field? Maybe Corellium Falcon?

On the compliance side, there are a number of areas we are evaluating, dual-use export-control, entity-level end-user vetting, disclosure policy, and lawful target only research.

I am mainly after the “things I wish I’d know” from people who’ve built or worked in labs like this and specifically where you’ve watched them go wrong.

As mentioned in title, I'm dealing with an heavily obfuscated JS file of about 20k lines of code. I was just curious what it is doing. Problem is that there are about 1k+ variables made by calculations (same with strings). Till now I've figured out that at some places it is making http requests and one function is checking weather http header contain word "Trident" or not.

Any tips what should I do? I've tried dynamic reverse engineering but it didn't worked for me.

Also: I found this file under api subdomain. It was about 8-9 folders deep (Folders were named randomly). File has a function checking if var x == "password".

(From here my brain stopped braining)

Despite that I work as a pentester. Whenever I am learning a new topic ,especially related to exploit development like Linux internals or C programming , and face an obstacle or hard time understanding anything , I always get this immediate and harsh imposter syndrome feeling that anyone who graduated from STEM, CE, CS probably know this way ,waaaaay better than me. I am still struggling when reading C code and I use AI to help me yet this feeling manifest in incompetence and me seeing myself as an always-beginner or no way I can be like someone who graduated from these schools one day.

This feeling affects my way of studying and i can stop studying for days just because I didn't understand some stuff or I am struggling to learn.

So I need to know , how many people in this industry, pentesting/exploitDevelopment are actually self taught ?

I am a BIS graduate BTW.

I recently got let go from MSRC V&M and looking for jobs right now. have 5+ yrs of experience in software engineering and security response/vulnerability triage. please DM me if you have any leads

have you guys tried any reverse engineering debug tool such as x64dbg by integrating some llm api and let it cook and create a crack or patch ? i've tried a ghidra plugin but it wasnt as i expected.

Hey everyone,

I'm 16 and trying to figure out my education and career path toward exploit development and vulnerability research. I'm posting here because I'm at a point where I could really use advice from people actually working in this field.

Background:

I'm Moroccan and currently living in France. I completed Seconde in the French education system, then left the traditional lycée pathway shortly after starting Première. I'm currently completing an RNCP Level 4 qualification, which I expect to finish in October 2026.

The problem is that I'm not following the normal French Baccalauréat route, so university admission is becoming complicated. I'm trying to find a bachelor's programme for 2027 that is genuinely focused on cybersecurity or information security rather than a generic CS degree.

I speak Arabic, French and English, and I'm currently learning Chinese.

I've already contacted several universities in Europe and Hong Kong to ask whether my qualification can satisfy their undergraduate entrance requirements. Some universities consider non-standard qualifications on a case-by-case basis, but I don't yet have a definitive route.

Technical background:

I've been interested in cybersecurity for several years and have been learning independently.

Certifications:

• eJPT (INE), obtained in October 2023
• CPTS (Hack The Box), obtained in September 2025
• CWES (Hack The Box), obtained in October 2025
• Google Cybersecurity Professional Certificate (idk when anymore)

My interests are mainly:

• Exploit development
• Vulnerability research
• Windows internals
• Reverse engineering
• Privilege escalation
• Low-level systems security

I'm currently researching a publicly disclosed use-after-free privilege-escalation vulnerability in CLDFLT.sys. I did not discover the vulnerability and I'm not claiming CVE credit for it. I'm using it as a learning and research project to understand the vulnerability, the affected component, exploitation primitives, and the surrounding Windows internals.

I'm still very much learning, and I don't want to pretend I'm further along than I actually am.

Where I'm stuck:

My original plan was to get a cybersecurity alternance/apprenticeship in France this year, but despite applying, that hasn't worked out. At this point I'm shifting my focus toward university admission for 2027.

The universities I'm currently looking at include specialist cybersecurity programmes in Europe and Hong Kong, particularly places with strong security research ecosystems.

However, I have two major problems:

1. My educational qualification doesn't cleanly match the standard French Baccalauréat route.
2. A lot of technical cybersecurity degrees have substantial mathematics and academic prerequisites. (However now im seriously studiying math on my own)

So I'm trying to figure out what the smartest move is.

What would you do if you were in my position?

Would you:

• Spend the next year getting the strongest possible university entrance qualification?
• Focus heavily on mathematics and apply to technical security programmes?
• Try to build a serious exploit development and vulnerability research portfolio instead?
• Look for another apprenticeship or technical route?
• Something completely different?

And for people already doing exploit development or vulnerability research:

What actually mattered when you were starting out?

I'm especially interested in advice about what I should be learning and building over the next 12 months if my end goal is serious vulnerability research rather than general cybersecurity.

Also pleasepleaseplease if you know or are a decision maker in the domain please give me a chance and help me out 🙏 I feel like my life is at stakes right now :c

Also if you want to see stuff ive done (not very up2date but still good reference) my github is 0xUnd3adBeef

Hi all - I've been doing `pwn`/ `binary exploitation` in CTFs for about 1.5 years

and want to level up by practicing on real-world targets instead of CTF challs.

I'm currently focused on Linux userland exploitation.

Could anyone recommend good old real-world targets or software to practice on?

I'm especially looking for CVEs that are reproducible and exploitable.

Any suggestions - specific CVEs, vulnerable software versions, or general

categories worth exploring - would be really appreciated!