Static scanner that flags nginx configs vulnerable to the two-pass capture-clobbering bug. Regex map + regex capture detection across ~50 directives and 13 call sites.

Two-stage scanner pairing LLM semantic analysis (Gemini 2.5) with deterministic AST/libclang call-graph reachability. Scout/Judge architecture. Found CVE-2025-64459 and CPython #143228.

Exploit for the FUSE readdir cache OOB write. Buddy-allocator grooming (PCP drain, page-swap) places the target at PFN+1 for page-cache corruption to passwordless root.

Full local privilege escalation from an unprivileged render-node race in DRM GEM change_handle. pipe_buffer spray, KASLR leak, DirtyPipe-style page-cache overwrite. 99% reliable.

PoC for the guest-triggered heap OOB read/write in KVM’s SEV-SNP Page State Change handler. Walks a guest-sized PSC buffer off its end to corrupt host kmalloc-cg-32 objects.

Three bugs in QEMU’s CXL mailbox emulation (heap overflow, write-what-where, type-confusion OOB read) chained into a deterministic guest-to-host escape with full ASLR bypass.

Pre-auth remote code execution PoC for the nginx PCRE capture clobbering bug. Heap overflow plus info leak chained to reliable RCE on Ubuntu 24.04 with full ASLR.

PoC for the SQL injection in Django’s core ORM via Q(**user_input) unpacking. Unsanitised _connector reaching WhereNode.as_sql bypasses ORM parameterisation.

Native shell from a Python heap gap. ctypes.Structure class-swap out-of-bounds to arbitrary code execution.