@thezdi@infosec.exchange

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 2w ago

CVE-2024-0244: Connor Ford details how he exploited the #Canon MF753Cdw printer back when he was a #Pwn2Own contestant. Now he's on the judging side as a ZDI analyst, but Doom is still on the table. https://www.zerodayinitiative.com/blog/2026/9/23/cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer

Zero Day Initiative

Zero Day Initiative — CVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer

With Pwn2Own Ireland 2026 coming up, I wanted to share an unreleased blog post from my time as a Pwn2Own contestant. This post covers the discovery and exploitation of CVE-2024-0244, which is an unauthenticated heap-based buffer overflow leading to an arbitrary free() in the Canon MF753Cdw printer

1

0

2

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 3mo ago

Our research team is back looking at CVE-2026-47291 - a CVSS 9.8 RCE bug in #Windows HTTP.sys. They show root cause and look at why detection may be just as hard as exploitation. https://www.zerodayinitiative.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys

Zero Day Initiative

Zero Day Initiative — CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack. Successful exploitation of this vulnerability can result in a denial-of-service condi

2

1

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 7mo ago

Announcing #Pwn2Own Berlin 2026! We've got 10 categories for targets, including an expanded #AI target list. We have 4 AI categories - including coding agents (looking at you #Claude). More than $1,000,000 in cash & prizes available. Read the details at https://www.zerodayinitiative.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026

Zero Day Initiative

Zero Day Initiative — Announcing Pwn2Own Berlin for 2026

If you just want to read the contest rules, click here . Willkommen zurück, meine Damen und Herren, zu unserem zweiten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). After our inaugural competition last year, Pwn2Own returns to Berlin and Offens

5

0

6

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 46mo ago

And that's a wrap! Congrats to DEVCORE for winning Master of Pwn for Toronto 2022. Thanks to all who participated and special thanks to #Google and #Synology for co-sponsoring the event.

7

0

9

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 46mo ago

At the end of Day 3 of #P2OToronto here's the current leaderboard. While DEVCORE is in the driver's seat - there is still a theoretical possibility that another team can still take a share of the lead. Let's see what our final day brings us! #Pwn2Own

2

0

2

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 46mo ago

On the first win of Day 3 of #P2OToronto, @biennd279 and @rskvp93 from Team Viettel (@vcslab) used a command injection on a WD NAS to help add a little extra holiday decoration to the venue! This nets the team another $20K and 4 MoP points! #Pwn2Own

0

1

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 46mo ago

Highlights from Day 1 of #Pwn2Own Toronto 2022: STAR Labs vs the #Samsung Galaxy S22

0

1

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 3mo ago

Our research team is back looking at CVE-2026-47291 - a CVSS 9.8 RCE bug in #Windows HTTP.sys. They show root cause and look at why detection may be just as hard as exploitation. https://www.zerodayinitiative.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys

Zero Day Initiative

Zero Day Initiative — CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack. Successful exploitation of this vulnerability can result in a denial-of-service condi

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 3mo ago

Our research team is back looking at CVE-2026-47291 - a CVSS 9.8 RCE bug in #Windows HTTP.sys. They show root cause and look at why detection may be just as hard as exploitation. https://www.zerodayinitiative.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys

Zero Day Initiative

Zero Day Initiative — CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack. Successful exploitation of this vulnerability can result in a denial-of-service condi

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 3mo ago

Our research team is back looking at CVE-2026-47291 - a CVSS 9.8 RCE bug in #Windows HTTP.sys. They show root cause and look at why detection may be just as hard as exploitation. https://www.zerodayinitiative.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys

Zero Day Initiative

Zero Day Initiative — CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack. Successful exploitation of this vulnerability can result in a denial-of-service condi

0

TrendAI Zero Day Initiative @thezdi@infosec.exchange

· 2mo ago

It seems #Apple can't avoid the ongoing Bug Apocalypse, as their CVE count jumps from 37 to 210 between June and July. Nothing appears to be under active attack. We parse it all out for you at https://www.zerodayinitiative.com/blog/2026/7/29/the-july-2026-apple-security-update-review

Zero Day Initiative

Zero Day Initiative — The July 2026 Apple Security Update Review

Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month’s 210. Quite a jump. For July 2026, Apple released 210 unique CVEs across iOS/iPad

0

1

0