cyberstan

Stan Shaw

I’m an independent security researcher focused on vulnerability discovery in widely-deployed infrastructure: operating system kernels, hypervisors, and language runtimes. My public work includes a pre-auth remote code execution in nginx’s script engine (CVE-2026-42533), a SQL injection in the Django ORM (CVE-2025-64459), a use-after-free in CPython’s perf_trampoline (Issue #143228), a guest-to-host escape chain in QEMU’s CXL Type 3 mailbox emulation (writeup), a guest-triggered heap out-of-bounds in KVM’s SEV-SNP page-state-change handling (CVE-2026-53360), and an independently-discovered local privilege escalation in the Linux DRM GEM subsystem (writeup). I also publish exploitation analysis of other researchers’ bugs, including a page-cache corruption chain for CVE-2026-31694 in the FUSE readdir cache. Additional findings in hypervisors, browsers and baseband are under coordinated disclosure and will be published here after patches ship.

Contact

Writing

Pre-auth RCE2026 · CVE-2026-42533
Capture clobbering in nginx’s script engine
A missing save/restore of PCRE capture state across the two-pass evaluator gives a heap overflow with controlled content and an info leak that defeats ASLR. Reliable pre-auth RCE.
Kernel LPE2026 · CVE-2026-31694
Out-of-bounds write in the FUSE readdir cache
A missing bounds check latent since 2018, armed by a name-length raise in 2024, overflows 24 bytes into an adjacent page-cache page. Exploitation writeup of a bug found by others.
Kernel LPE2026 · CVE-2026-46215
Use-after-free in DRM GEM change_handle
An unprivileged render-node race frees a GEM object under a live handle and chains to passwordless root. Found independently.
KVM heap OOB2026 · CVE-2026-53360
Heap out-of-bounds in KVM SEV-SNP
A malicious SEV-SNP guest walks a guest-sized PSC buffer off its end to read and corrupt the host kernel heap.
VM escape2026 · QEMU
Guest-to-host escape via QEMU CXL mailbox
Three CXL Type 3 mailbox bugs chain into a deterministic guest-to-host escape with a full ASLR bypass.
Runtime UAF2026 · #143228
A race condition in CPython’s perf_trampoline
A race in the profiler trampoline teardown leaves a freed arena reachable; fixed with arena refcounting.
ORM SQLi2025 · CVE-2025-64459
SQL injection in the Django ORM
Unsafe formatting of the Q object connector allows injection through Q(**user_input).

All writing →