One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux

Long-form version of Quentin Kaiser's Hexacon 2026 talk: a WPS EAP reassembly overflow in Broadcom's proprietary 802.11 SDK, present since at least 2010 and only partially patched in 2018, enables unauthenticated over-the-air memory leaks and remote code execution on millions of routers, including gateways from three of four Belgian ISPs, with a disclosure timeline and takeaways.

Research · Security · Vulnerability Research · Networking · Hardware

PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)

pwn.ai's write-up of how Vercel's $1M Sandbox challenge led to a Linux networking bug where guest-controlled checksum metadata could rewrite an IPv4 header after validation, escalating from a 32-byte host-memory disclosure to a full guest-to-host KVM escape, with the upstream fix and patch timeline.

Research · Security · Linux · Virtualization · Vulnerability Research

SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data

Noma Labs describes SneakPeek, an exploit chain in Claude Code Desktop's preview pane: HTML files over 256KB loaded via file:// URLs escaped the Content Security Policy and request filter, letting a poisoned file in a public repo read and exfiltrate local secrets. Anthropic rated it CVSS 8.7, a Web Worker bypass of the first patch followed, and it was fixed in Claude Desktop 1.30096.1.

Research · Security · AI · Vulnerability Research

1-click MMI execution in Android

Karan Saini shows that Android apps holding CALL_PHONE can run carrier MMI/USSD codes without user confirmation, demonstrates one-tap call-forwarding registration from a Chrome link through the ACR Phone dialer's browsable intent, and notes how Android 17 masks the calling app's identity, with a disclosure timeline for the vendor and Google.

Research · Security · Android · Vulnerability Research

Telegram Desktop: one-click account takeover via IPC injection

A BeakSec writeup of CVE-2026-107181: an unescaped separator in Telegram Desktop's single-instance IPC let a single clicked link inject commands that reach the internal interpret: scheme, read arbitrary local files such as session files, and send them to an attacker's chat. Fixed quietly in 7.2.9.

Research · Security · Vulnerability Research

Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

Calif describes vulnerabilities it reported to OpenBSD, including a shared-memory attachment counter defined as a signed 16-bit short in the original BSD sources roughly 37 years ago. Overflowing it enabled a use-after-free that, combined with a separate kernel out-of-bounds write, gave local root despite KARL and SMAP; fixes shipped as errata 026 and 018.

Research · Security · OpenBSD · Operating Systems · Vulnerability Research