Nebula Security

Website: nebusec.ai  路  Twitter @nebusecurity  路  Bug list (885+)

## Latest research - **IonStack part I**: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT
[Firefox SpiderMonkey] 馃摉 [Writeup](https://nebusec.ai/research/ionstack-part-1-cve-2026-10702/) 路 馃惁 [Twitter](https://x.com/nebusecurity/status/2074663573742338256) 路 馃敆 [Source code](https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-10702) - **IonStack part II**: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
[Linux Kernel] 馃摉 [Writeup](https://nebusec.ai/research/ionstack-part-2) 路 馃惁 [Twitter](https://x.com/nebusecurity/status/2081894761284415674) 路 馃敆 [Source code](https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499) - **Longinus**: 2 Boundaries in One Bug, Piercing Chrome's Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307
[Chrome V8] 馃摉 [Writeup](https://nebusec.ai/research/v8-cve-2026-6307-writeup) 路 馃惁 [Twitter](https://x.com/nebusecurity/status/2071587218205086149) - **Nginx-QuicBurst**: First public Nginx RCE on a generic config with an ASLR bypass, CVE-2026-42530
[Nginx] 馃惁 [Twitter](https://x.com/nebusecurity/status/2067623683427045541) 路 馃敆 [Source code](https://github.com/NebuSec/CyberMeowfia/tree/main/Nginx-QuicBurst) - **Nginx-PoolSlip**: First public Nginx RCE with an ASLR bypass, CVE-2026-9256
[Nginx] 馃惁 [Twitter](https://x.com/nebusecurity/status/2057071579876753643) 路 馃敆 [Source code](https://github.com/NebuSec/CyberMeowfia/tree/main/Nginx-PoolSlip) - **How an Omitted Write Barrier in V8 Turns Into RCE in Chrome**: CVE-2026-5865
[Chrome V8] 馃摉 [Writeup](https://nebusec.ai/research/v8-maglev-incorrect-phis-untagging) 路 馃惁 [Twitter](https://x.com/nebusecurity/status/2052842241828561208) 路 馃敆 [Source code](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Chrome-CVE-2026-5865) - **From a Netfilter Bug to kernelCTF**: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10,500 Bounty
[Linux Kernel] 馃摉 [Writeup](https://nebusec.ai/research/cve-2026-23274-cos) 路 馃惁 [Twitter](https://x.com/nebusecurity/status/2044499901082702065) 路 馃敆 [Source code](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-23274) ## N-day Research - CVE-2026-64560: LPE on Linux and Android 路 馃敆 [Source code](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Ndays/Android-CVE-2026-64560) - CVE-2026-43074: LPE on Linux and Android 路 馃敆 [Source code](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Ndays/Android-CVE-2026-43074)