Shadow Chaser Group is a sub-group of the GcowSec team which consists of college students who love it.Shadow Chaser Group focused on APT hunt and analysis
Earth
Joined April 2020
- Tweets3.1K
- Following573
- Followers11.1K
- Likes2.8K
Pinned Tweet
Hi,bro
Shadow Chaser Group is a sub-group of the GcowSec team which consists of college students who love it.Shadow Chaser Group is focus on #APT hunte and analysis
I hope you will follow us :-)
Shadow Chaser Group retweeted
We're thrilled to have contributed a V8 vulnerability to one of this year's four $250K Chrome full chain exploits. The vulnerability was subtle enough that Google needed multiple commits to finally fix it.
However, we would like to take a step further. To convince Fortune to smile upon us deterministically. We managed to use LLM-assisted formal verification to rediscover the bug. The same approach can prove security properties of functions and APIs.
Will share writeup and more about formal verification work soon. We will build more Chrome full chains!
We just received a $250,000 Chrome Full Chain bonus! 🎉
We've claimed the second Full Chain bonus of 2026. Only two remain!
Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched.
Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research.
P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!
Shadow Chaser Group retweeted
Remember when scam callers only ask for your password? Good times.
Now picking up a wrong call can get you hacked.
Telegram RCE discovered by NebuSec Code Security, powered by GPT-5.4.
Yes, GPT-5.4. We turned a dinosaur model into a cyber powerhouse.
Fixed in Telegram Android 12.10.4（7099)
Shadow Chaser Group retweeted
"Bad UVM" - Privilege Escalation, Container Escape via NVIDIA GPU UVM - hijack read-only page cache.
More details: medium.com/@guoziyi114/bad-u…
Shadow Chaser Group retweeted
Fixing carbon buildup in a turbocharged engine might cost you $55,000. Here is how we exploited a flaw we found in Google V8's Turboshaft.
We received reports that this vulnerability was exploited against some products. Make sure your Chromium is up to date. Writeup below.
Shadow Chaser Group retweeted
25 elite hacking teams raced in the final kernelCTF. NebuSec closed out the history of the classic kernelCTF with 99% exploit stability, 0.1s exploit time, and 0.000461s submission time.
We’ll soon open-source our kernelCTF infra and a walkthrough of how we won every kCTF we entered, and pushed our time cost down to the absolute minimum.
Shadow Chaser Group retweeted
CVE-2023-2156 was believed to be just a remote kernel DoS, patched in 2023.
We found a bypass and achieve privilege escalation and container escape.
Read the $10,500 story of CVE-2026-43501 "Route of Root":
nebusec.ai/research/cve-2026…
Shadow Chaser Group retweeted
Amazing work.
Quick POC using @nebusecurity CVE-2026-43499 to root my bootloader locked US S25 (SM-S931U1). Btw this works on latest fw. This phone is Android 16, June update.
nebusec.ai/research/ionstack…
I have detailed notes on flashing, exploitation, offset finding etc, blog post later 🖖
Shadow Chaser Group retweeted
We’ve open-sourced one-click Docker setups and full exploits for Nginx-{PoolSlip, QuicBurst}, both with remote ASLR bypasses.
Try them here:
github.com/NebuSec/CyberMeow…
PoolSlip's OOB write leaks ASLR data extremely fast, while QuicBurst's UAF takes longer.
Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security.
This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version.
This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.
Shadow Chaser Group retweeted
Here's the final chapter of our IonStack series, the Android rooting part.
Including how we use GhostLock (CVE-2026-43499) to defeated KASLR on Android and bypassed KCFI to get arbitrary kernel memory read and write:
nebusec.ai/research/ionstack…
Shadow Chaser Group retweeted
We can easily find more vulnerabilities, the reason we didn't do that is simply we don't have enough people to patch them all.
During our first scan in Feb, we found 600+ vulnerabilities in Linux kernel and till nowadays 100+ patches were merged and we are still fixing the rest of them...
Let’s meet in person and chat about how we use AI to solve real-world security problems.
Nebula Security has discovered more than 1,000 vulnerabilities across the Linux kernel, Google Chrome, Mozilla Firefox, NGINX, WordPress, and many other open-source projects.
Our pipeline combines threat-model generation, vulnerability discovery, finding verification, and patch generation into a single end-to-end product security experience.
We can secure the world's most complicated software, we can secure your codebase.
Book a time to meet us at Black Hat:
nebula-security.cal.com/eten…
Shadow Chaser Group retweeted
After the Hugging Face incident, have you wondered how easy it is to escape a modern agent sandbox?
We benchmarked eight open-source agent sandboxes to show how vulnerable they can be, and why frontier models can break out so easily.
Shadow Chaser Group retweeted
Do you enjoy vibe-coding piles of open-source software that nobody uses? Shipping self-indulgent products and wondering why nobody else seems impressed? Want to know what someone outside your own head might think of your product? github.com/ZacharyZcR/annoyi…
Shadow Chaser Group retweeted
Watch us open the camera and uncover the anonymous identity behind Tor browser:
We published the writeup for the browser RCE in IonStack. Mythos reported 271 bugs in Firefox 150 but still missed this one. And the Tor Browser is also affected by CVE-2026-10702.
Update your Tor!
Shadow Chaser Group retweeted
Try a live IonStack root on your Pixel 10: rootme.nebusec.io
In the IonStack demo, we left the rootme URL visible and put up a giant countdown as a tribute to jailbreakme.
Shadow Chaser Group retweeted
GhostLock (CVE-2026-43499) is a 15yr old kernel 0-day we used in IonStack full chain exploit.
Everything around you, as long as it runs Linux, from IoT to mobile to desktop, is affected.
Read how we won $92,337 bug bounty with GhostLock and see our exploit on Github. Link below
Shadow Chaser Group retweeted
For this (maybe last) year of SekaiCTF I made a fullchain challenge, chaining together an 0-day in ladybird/libjs, an 0-day qemu TCG LPE and a n-day qemu escape:
qyn.app/blog/sekaictf-2026-3…
We also re-released another challenge with a running bounty until next week!
Shadow Chaser Group retweeted
R3CTF 2026 has come to a successful close. Please join us in congratulating this year’s award-winning teams!
🥇 BBBB
🥈 EQST
🥉 @ProjectSEKAIctf
Thank you to our sponsors @nebusecurity @osec_io @zellic_io @vector35 @googlecloud
Hope see you next year!
