Ikotas Labs, Inc. / News
Vulnerability research, competitions, and insights from the front lines of offensive security.
CODEGATE 2026 CTF Finals General Track: 1st Place Worldwide, Earning ₩50,000,000
BunkyoWesterns, a team including our members, took 1st place worldwide at CODEGATE 2026 CTF Finals (General track) held in South Korea, earning a first-place prize of ₩50,000,000.
Read more →
Firefox 153.0 Vulnerability Discovery and Disclosure (CVE-2026-16373)
Our member discovered an information disclosure vulnerability in the Privacy component of Firefox for Android and reported it to Mozilla.
Read more →
Launching Ikotas Exploit Development Training, Our Practical Exploit Development Program
We are launching Ikotas Exploit Development Training, a practical training program centered on LLM-assisted exploit development. A hands-on training tailored to each participant, covering the major targets researchers work against from an attacker's perspective and walking through the flow from vulnerability analysis to constructing exploits that actually succeed.
Read more →
Discovery and Disclosure of 14 Vulnerabilities in TeX Live, Including Arbitrary Code Execution
Our team discovered multiple memory safety vulnerabilities that lead to arbitrary code execution in tools shipped with the TeX Live typesetting system, and reported them to the developer under coordinated disclosure. We demonstrated that arbitrary code execution is achievable on the official distribution binaries simply by compiling a malicious document.
Read more →
Launching Ikotas AI×Security Training, Our Practical Security Training Program
We are launching Ikotas AI×Security Training, a practical training program for putting AI agents to work in real security operations. A hands-on series covering AI utilization across security workflows from an attacker's perspective.
Read more →
Midnight Sun CTF 2026 Finals 1st Place Worldwide
BunkyoWesterns, a team including our members, took 1st place worldwide at Midnight Sun CTF 2026 Finals held in Sweden.
Read more →
Discovery and Disclosure of a Linux Kernel Privilege Escalation 0-day
Our member discovered a local privilege escalation 0-day on the latest Linux kernel, chaining two kernel bugs, and reported it to the vendor.
Read more →
Firefox 151.0 Vulnerability Discovery and Disclosure (CVE-2026-8947, CVE-2026-8964)
Our member discovered vulnerabilities in Firefox's DOM: Bindings (WebIDL) and Popup Blocker components and reported them to Mozilla.
Read more →
Pwn2Own Berlin 2026 Day 3: Exploited an AI Agent, Earning $20,000 and 4 Master of Pwn Points (OpenAI Codex)
Our member competed on day 3 of Pwn2Own Berlin 2026 and successfully exploited OpenAI Codex, an AI coding agent.
Read more →
Pwn2Own Berlin 2026 Day 1: Earned $28,000 and 3.75 Master of Pwn Points (Megatron Bridge, LiteLLM)
Our member competed on day 1 of Pwn2Own Berlin 2026 and successfully exploited NVIDIA Megatron Bridge and LiteLLM.
Read more →
Discovery and Disclosure of an RxGK Variant in the Linux Kernel Privilege Escalation Vulnerability Family "Dirty Frag"
Our member discovered a new privilege escalation variant of the Dirty Frag family in the Linux kernel's RxRPC RxGK security class.
Read more →
Firefox 150.0 Vulnerability Discovery and Disclosure (CVE-2026-6768, CVE-2026-6769)
Our member discovered vulnerabilities in Firefox's Networking: Cookies and Debugger components and reported them to Mozilla.
Read more →