Security expert and CTO @Reverse_Tactics
Joined April 2017
- Tweets418
- Following413
- Followers1.7K
- Likes1.5K
Oops ! He did it again
💥 Introducing "Zapscape" (CVE-2026-64561)
A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU's recursive "ZAP" path. Can escape to the host on x86 public clouds that expose nested virtualization.
A separate vulnerability from Januscape. If you match the vulnerable conditions, apply the patch immediately.
Details: zapscape.io
cbayet retweeted
We're partnering with @huggingface to investigate an unprecedented security incident.
Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.
Sharing preliminary findings to help defenders understand emerging risks:
openai.com/index/hugging-fac…
cbayet retweeted
You may have missed it but Hexacon 2026 is sold out!
However, we still holds some tickets for people that want to register for a training+event: hexacon.fr/register/
Upon registering for a training, you will get a prompt asking if you want an event entry:
Thanks to former students for their feedback and recommendations!
Last week, our training “Bug Hunting in Hypervisors” was at @reconmtl 2026.
Class was fully booked with 16 seats, most of them were there because a former student recommended it.
We didn’t expect word of mouth to kick in that fast !
Book now for our session at @hexacon_fr !
Here's one !
xitter.cf/i/status/2068494484300…
cbayet retweeted
Last week, our training “Bug Hunting in Hypervisors” was at @reconmtl 2026.
Class was fully booked with 16 seats, most of them were there because a former student recommended it.
We didn’t expect word of mouth to kick in that fast !
Book now for our session at @hexacon_fr !
cbayet retweeted
📢 CALL FOR PAPERS IS OPEN! 📢
Ready to share your latest security research with the community at Hexacon? The stage is yours.
Submit your talks here: hexacon.fr/conference/call-f… 💻✨
cbayet retweeted
Bug Hunting in Hypervisors by Corentin Bayet (@OnlyTheDuck) and @BrunoPujos
📅 Oct 12-15
📍 Espace Vinci or Espace Cléry, Paris 2nd
👉 hexacon.fr/trainer/bug_hunti…
Really proud to be a trainer at @hexacon_fr !
We’re proud to bring our" Bug Hunting in Hypervisors" training to @hexacon_fr (October 12th–15th, 2026) !
Designed for security researchers,we will dive into VM escapes, hypervisor attack surfaces, and real-world exploitation.
See you there !
cbayet retweeted
[ZDI-26-188|CVE-2025-41237] (Pwn2Own) VMware ESXi VMCI Integer Underflow Local Privilege Escalation Vulnerability (CVSS 8.2; Credit: Corentin "@OnlyTheDuck" BAYET from REverse Tactics) zerodayinitiative.com/adviso…
Awesome bp on a Workstation escape using a bug I also found in 2024, and never managed to exploit... Found the ESXi vuln I used at the same #Pwn2Own while looking for interesting objects to overwrite with the LFH OOB 😅
Those guys found the bug and exploited it in a few days !
At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller.
Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit.
🔍 Full technical write-up 👇
synacktiv.com/en/publication…
This bug is found and triggered by students of our training 😉
reversetactics.com/trainings…
Will be at @reconmtl again this year 🥰
cbayet retweeted
🚨 REcon 2026 is LIVE!
🚀 Call for papers and registration are now open!
Join the world's top reverse engineers & exploit devs in Montreal:
🛠 Trainings: June 15-18 (19 hands-on classes – AI agents, kernel exploits, Rust/Go reversing, fault injection & more!)
📅 Conference: June 19-21
Tickets & early bird now open → recon.cx
Shoutout to the legends teaching: @SinSinology @KyleMartin @MalachiJonesPhD @andreyknvl @mr_phrazer @yarden_shafir @DrCh40s @pulsoid
+ more elite instructors! See website for all trainers and session info.
Limited spots – see you in MTL! #REcon2026 #ReverseEngineering
cbayet retweeted
Our latest post details how we exploited Retbleed (a CPU vulnerability) to compromise a machine from a sandboxed process and VM!
Curious? 👇
bughunters.google.com/blog/6…
Love the top-bottom approach of this blogpost ! A great way to explain internals in my opinion, and the kind of reference you look when you're trying to exploit a heap bug. Also glad to see that our paper (with @paulfariello) of 2020 is still relevant !
Good morning! Just published a blog post diving into Windows Kernel Pool internals: basics, memory allocation functions, internal structures, and how Segment Heap, LFH, and VS work.
r0keb.github.io/posts/Window…
Jet lag hit hard but still really enjoyed @typhooncon, Seoul and meeting new friends 😁
@typhooncon is already over, but we enjoyed every minute ! During our talk "Journey To Freedom", we disclosed for the first time the details on the Windows LPE we used at Pwn2Own Vancouver 2024 after escaping from VirtualBox. Slides are already available: reversetactics.com/publicati…
cbayet retweeted
🌪️ Back from lunch just in time to escape VirtualBox and unchaining objects in the Windows Kernel with Corentin Bayet
cbayet retweeted
Slides and video of our talk at @offensive_con are already online !
Thanks to @Binary_Gecko for the amazing event
reversetactics.com/publicati…