Hacking Lab Hacking Lab Home People Publications Contact Light Dark Automatic QueryHouse: Cross-DBMS Differential Testing with LLM and Query Transpilation Seoyeon Oh , Juhyun Song , Jaemin Park , Kwanghee Lee , Minae Hyeon , Minji Kim , Sehyuk Ka , Gwangwun Jung , Brian Pak , Insu Yun September […]

# Autonomous AI Intrusions Are Here: Lessons from the Hugging Face Compromise Hugging Face disclosed an intrusion that, according to them, was driven end to end by an autonomous AI agent system. Along similar lines, Sysdig recently published a blog on JADEPUFFER, which it assesses to be an agent-driven ransomware […]

# Rustifying Image Codecs in Chromium > A cross-team effort to make browser image decoding safer without slowing the web down. ## Introduction Image decoding is on the hot path in every modern browser. Page loads, “ tags, and favicons all require parsing bytes straight from the untrusted web. Media […]

On Ethereum block `25118335` at `2026-05-17T23:55:23Z`, attacker EOA `0x5abb91b9c01a5ed3ae762d32b236595b459d5777` called bridge dispatcher `0x71518580f36feceffe0721f06ba4703218cd7f63` and drained bridge-held assets to drainer `0x65cb8b128bf6e690761044cceca422bb239c25f9`. The trace shows a BTC-import and proof-processing flow followed immediately by bridge payouts, which is consistent with a logic error in the bridge’s import/proof path rather than a flash-loan or […]

# Bad News for the Average Pentester With the changes to the market of late, Atredis has actually been exceedingly busy. We’ve been working with AI and related tech since we started the company over a dozen years ago, but in the last year, like everyone, our work has changed: […]

This Ethereum transaction occurred on 2026-05-16 18:28:23 UTC and is not the exploit execution path for the Adshares Wrapper incident. The trace shows a single zero-value `CALL` from `0xcb6af4e5e29d66A14af1F516BaAF1D5F7d8F6b84` to `0x63e22ce9bde9bb8892a447258abfcaa4142f001b` carrying plaintext calldata that repeats the whitehat return message from the alert. No internal calls, logs, token transfers, or […]

On Ethereum at 2026-05-16 18:15:23 UTC, transaction `0x99a1114c2e8dc1807e00da0e963a6fbd5d91a04d1e1fd0a75b78e9c6b41a7464` was an on-chain plaintext settlement message related to Adshares Wrapper, not the drain transaction itself. The trace shows a single zero-value `CALL` from `0xb6fe3854a85dc6c2a873f2b6bbd43a36c74cae1f` to EOA `0x63e22ce9bde9bb8892a447258abfcaa4142f001b`, with ASCII calldata offering whitehat terms and requesting return of 90% of previously drained assets. […]

PHP is one of the world’s most popular programming languages. The PHP core itself is rarely perceived as an attack surface — attention usually shifts to frameworks and third-party libraries. However, a significant portion of real-world application logic relies on built-in functions from the ext/standard extension, which handles strings, query […]

# Saved passwords in Edge memory: what we’re changing and why Browsers help protect some of the most sensitive data people have, including passwords. That’s why we continuously review how Edge handles that data, and where we can further reduce exposure through defense-in-depth improvements as part of Microsoft’s Secure Future […]

Talk presented at **Qualcomm Product Security Summit (QPSS) 2026**. The talk revisits a neglected attack surface in Android’s biometric authentication flow and explores how weaknesses around biometric AuthToken handling can be abused to crack PINs and bypass Credential Encrypted (CE) protection.