A security researcher exploited a public Linux kernel bug in Google's kernelCTF challenge by manipulating CPU TLB shootdown behavior to maintain a stale memory mapping, then convinced the kernel to recycle the underlying physical page as a page table, ultimately gaining control to retrieve the flag. The exploit leveraged existing public vulnerability details rather than discovering a new bug.
An article argues that LLMs are real technological tools, but public discourse around AI capabilities is distorted by fear-mongering from industry insiders. It debunks the narrative surrounding OpenAI chatbots allegedly hacking Hugging Face servers by explaining that the 'autonomous' behavior was simply a Python program querying an LLM based on historical CTF challenge data.
An article critiques how AI companies and media misrepresent large language models' capabilities, using the example of OpenAI's chatbots completing a hacking challenge at Hugging Face. The author argues that LLMs are real tools but claims of autonomous AI behavior are exaggerated, driven by corporate incentives and sensationalized media narratives.
This technical post explains DNS wildcard records, which match any subdomain via patterns like *.example.com, and presents three detection approaches for identifying them during subdomain enumeration in bug bounty hunting and CTF activities. The post details how wildcards work per RFC specifications, their interaction with load balancers, and practical methods including querying nonexistent subdomains, querying the wildcard directly, and counting returned IP addresses.