CVE-2025-23298: Trend ZDI's @gothburz.bsky.social covers an RCE in the #NVIDIA Merlin Transformers4Rec library. He details the root cause and the patch to fix it. Finally, he highlights highlights several important lessons for the AI/ML security community. www.zerodayinitiative.com/blog/2025/9/...

No time to read the blog? Just like living walls and shrubbery? Check out the Patch Report for September 2025. @dustinchilds.bsky.social summarizes the Patch Tuesday release from the @TrendMicro Dallas office and points out the patches with extra flair. youtu.be/TIkwpdP2YAU

It's a moderate release from both #Adobe and #Microsoft, but there's still lots to cover. Join @dustinchilds.bsky.social as he breaks down the September Patch Tuesday and highlights some fixes that require some extra attention. www.zerodayinitiative.com/blog/2025/9/...

We're prepping for #Pwn2Own Ireland. We have a surge protector filled with #Amazon smart plugs, with #Philips Hue Bridge devices, which are controlling the lights. And ignore the surge protector going into a surge protector plugged into a extension cord. Don't try this at home, we're professionals.

We have updated the #Pwn2Own Ireland rules to clarify scoping for WhatsApp for Windows. For WhatsApp for Windows, both “WhatsApp” and the “WhatsApp Beta” applications are in scope for the competition. #P2OIreland www.zerodayinitiative.com/blog/2025/7/...

We have updated the rules for #Pwn2Own Ireland to clarify which printer models are in scope. The HP DeskJet 2855e is the new target, which is more widely available. The rules are at www.zerodayinitiative.com/Pwn2OwnIrela...

Microsoft fixes “BadSuccessor” Kerberos vulnerability (CVE-2025-53779) 📖 Read more: www.helpnetsecurity.com/2025/08/13/m... #cybersecuritynews #patchtuesday @microsoft.com @tenablesecurity.bsky.social @satn.am @qualysofficial.bsky.social @dustinchilds.bsky.social @thezdi.bsky.social

No time to read the patch blog? Just want to put it on double speed and hear @dustinchilds.bsky.social talk silly? The Patch Report for August 2025 is now available. youtu.be/agMv21gLZI8

We've managed to make it through hacker summer camp, and #Microsoft and #Adobe survived enough to deliver their latest security patches. Join @dustinchilds.bsky.social as he breaks down another large Patch Tuesday release. www.zerodayinitiative.com/blog/2025/8/...

Congrats to Ken Gannon of NCC Group for winning the Pwnie for Best Mobile Bug for his #Samsung exploit he used at #Pwn2Own Ireland! We hope he returns in a few weeks with something even better.

Great to see Trend ZDI researchers Jonathan Andersson  and Thanos Kaliyanakis present their findings on EV Charger security. We heard things got a bit flammable. #Blackhat

Announcing #Pwn2Own Ireland for 2025! We return to the Emerald Isle with our new partner #Meta & a $1,000,000 WhatsApp bounty. Plus new USB vectors on phones & more. Read the details https://www.zerodayinitiative.com/blog/2025/7/30/pwn2own-returns-to-ireland-with-a-one-million-dollar-whatsapp-target

Microsoft is investigating whether a leak from its early alert system for cybersecurity companies allowed Chinese hackers to exploit flaws in its SharePoint service before they were patched

CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability: ZDI analyst Bobby Gould details this bug and another that may be a dupe. He also shows how it can be exploited. www.zerodayinitiative.com/blog/2025/7/...

The critical RCE Vulnerability in Microsoft #SharePoint was disclosed at #Pwn2Own in May. Because of Trend @thezdi.bsky.social, our customers have been protected since May. Stay up to date on the latest with this vulnerability here: https//www.trendmi...

CVE-2025-4941 - Trend ZDI analyst Hossein Lotfi details the Firefox bug used at #Pwn2Own Berlin by Manfred Paul. Includes root cause analysis and video demo. www.zerodayinitiative.com/blog/2025/7/...

#Adobe has (finally!) released their updates for July. 13 bulletins addressing 60 CVEs in various products. Nothing is listed as under active attack. The patch blog has bee updated with all the details. www.zerodayinitiative.com/blog/2025/7/...

It may be a little late (looking at you @adobe.com) but the Patch Report for July is now available. Join @dustinchilds.bsky.social as he breaks down the Microsoft release and contemplates where Adobe patches may have gone. youtu.be/BhkZ9llB5d0

The #Adobe patches may be late, but 130 new CVEs from #Microsoft, there's still plenty to talk about. Join @dustinchilds.bsky.social as he covers the release and point out why it's a bad month to be a SQL Server admin. www.zerodayinitiative.com/blog/2025/7/...

Extracting Embedded MultiMediaCard (eMMC) contents in-system. ZDI researcher Dmitry Janushkevich details how to interact with an eMMC chip and notes some pitfalls you may encounter on the way. www.zerodayinitiative.com/blog/2025/6/...

🚨 Long-time sponsor announcement 🚨 "Trend ZDI (@thezdi.bsky.social) is honored to be a continuing sponsor of Hexacon. Join us there to see some of the latest in offensive research and reverse engineering. We hope to rendez-vous with you in Paris." www.zerodayinitiative.com

No time to read the blog? Just want the highlights of what to prioritize (and what to look out for)? Check out the Patch Report for the June Patch Tuesday release. @dustinchilds.bsky.social provides all the details, including a silent patch from last month. youtu.be/5RJqjm6VpQg

It's a mild release from #Microsoft and a record-breaking release from #Adobe. There's a single 0-day to deal with in WEBDAV and, as always, a few deployment challenges. @dustinchilds.bsky.social provides all the details at www.zerodayinitiative.com/blog/2025/6/...

Demonstrating CVE-2025-4919: Now that it's patched, we can show you how Manfred Paul used this code execution bug in the renderer of #Mozilla Firefox to win $50,000. youtu.be/TG029NAGKs0 #Pwn2Own #P2OBerlin

In another video highlight from day three of #Pwn2Own Berlin, Dung and Nguyen of STARLabs take on Oracle VirtualBox - and they add on a Windows kernel LPE to completely take over the system. youtube.com/shorts/vLZLA...

In another video highlight from day three of #Pwn2Own Berlin, Nir Ohfeld & Shir Tamari of Wiz Research target NVIDIA Container Toolkit. They also talk about how long they researched the bug they used. youtube.com/shorts/iapJl...

In a video highlight from day three of #Pwn2Own Berlin, Manfred Paul takes on Mozilla Firefox (and his own nerves). youtube.com/shorts/Xe9RO...

In another video highlight from day two of #Pwn2Own Berlin, Viettel Cyber Security used an OOB Write for their Guest-to-Host escape on Oracle VirtualBox on their second attempt. youtube.com/shorts/cczvm...

In another video highlight from day two of #Pwn2Own Berlin, Gerrard Tai of STAR Labs SG Pte. Ltd takes on Red Heat Linux and explains why his first attempt failed. youtube.com/shorts/vBXAC...

In another video highlight from day two of #Pwn2Own Berlin, Edouard Bochin and Tao Yan from Palo Alto Networks successfully target Mozilla Firefox. youtube.com/shorts/nu6D9...

In a video highlight from day two of #Pwn2Own Berlin, Mohand Acherir & Patrick Ventuzelo of FuzzingLabs exploit the #NVIDIA Triton Inference server youtube.com/shorts/Xuol5...

In a video highlight from Day One of #Pwn2Own Berlin, Team Viettel targets the #NVIDIA Triton Inference server. youtube.com/shorts/dlPjB... #P2OBerlin

Congrats to @mozilla.org for being the first vendor to patch their #Pwn2Own bugs. Oh - and go update #Firefox to get the fixes. That's two years in a row Mozilla has been the fastest. Well done!

How China Is Building an Army of Hackers. With commentary from ZDI's Dustin Childs and footage from #Pwn2Own Automotive youtu.be/8kpnSb4yGR0?... via @YouTube

#Pwn2Own Berlin 2025 is complete! In total, we awarded $1,078,750 for 28 unique 0-days. Join Brian Gorenc and Dustin Childs as they recap the highlights (and some lowlights) from this year's event. youtu.be/G7McB7L7sIs #P2OBerlin

This was our first year having an AI category at #Pwn2Own, and we weren't sure what to expect. What we got was some great research across four different frameworks. youtube.com/shorts/OY64_... #P2OBerlin

Pwn2Own Berlin 2025 comes to a close. We awarded $1,078,750 for 28 unique 0-days. Congrats to STAR Labs SG for winning Master of Pwn with $320,000. Thanks to @offensivecon.bsky.social for hosting, and thanks to all who participated. Can't wait to see you next year! #Pwn2Own #P2OBerlin

Our final entry for @Pwn2Own Berlin has been confirmed as a win! Miloš Ivanović used a race condition bug to escalate privileges to SYSTEM on Windows 11. His fourth-round win nets him $15,000 and 3 Master of Pwn points.

Confirmed! Thomas Bouzerar and Etienne Helluy-Lafont from Synacktiv used a heap-based buffer overflow to exploit #VMware Workstation. They earn $80,000 and 8 Master of Pwn points - sending the contest to over $1,000,000 total! #Pwn2Own

Boom! Thomas Bouzerar and Etienne Helluy-Lafont from Synacktiv close out #Pwn2Own in style with a guest-to-host escape in VMware Workstation. If confirmed, it will put the total contest payout at over $1,000,000! #Pwn2Own

Nice! #Pwn2Own newcomer Miloš Ivanović successfully demonstrated his privilege escalation on #Windows 11. He heads off to the disclossure room to discuss how he did it. #P2OBerlin

A successful collision! Corentin BAYET from Reverse Tactics used 2 bugs to exploit ESXi, but the Use of Uninitialized Variable bug collided with a prior entry. His integer overflow was unique though, so he still earns $112,500 & 11.5 Master of Pwn points. #Pwn2Own

Confirmed!! Dung and Nguyen of STARLabs used a TOCTOU race condition to escape the VM and an Improper Validation of Array Index for the Windows privilege escalation. They earn $70,000 and 9 Master of Pwn points. #Pwn2Own

Unfortunately, the team from STAR Labs could not get their exploit of NVIDIA's Triton Inference server working within the time allotted. #Pwn2Own

Sweet! Corentin BAYET (@OnlyTheDuck) from @Reverse_Tactics barely needed a second to demonstrate his exploit against VMware ESXi. He heads off to the disclosure room to provide the details of his work. #Pwn2Own #P2OBerlin

Amazing! Nir Ohfeld and Shir Tamari of Wiz Research used a External Initialization of Trusted Variables bug to exploit the #NVIDIA Container Toolkit. This unique bug earns them $30,000 and 3 Master of Pwn points.

Confirmed! Former Master of Pwn winner Manfred Paul used an integer overflow to exploit #Mozilla Firefox (renderer only). His excellent work earns him $50,000 and 5 Master of Pwn points. #Pwn2Own #P2OBerlin

We have another AI collision. Although @namhb1, @havancuong000, and @HieuTra34558978 of FPT NightWolf successfully exploited #NVIDIA Triton, the bug they used was know by the vendor (but not patched yet). They still earn $15,000 and 1.5 Master of Pwn points. #Pwn2Own

Just amazing. Dung and Nguyen of STARLabs not only demonstrated their guest-to-host exploit of #Oracle VirtualBox, they added on a Windows kernel vulnerability to take over the system. Tremendous work. They head off to disclosure with the details. #Pwn2Own #P2OBerlin

Sweet! #Pwn2Own veteran Manfred Paul wasted no time exploiting #Mozilla Firefox in the web browser category. He's off to the disclosure to provide the details to the Mozilla developers. #P2OBerlin