Frank Wu
Founder of Nebula Security, Autonomous AI defense system for cyber attack
Company
Frank Wu is listed as a founder of Nebula Security. Nebula Security is founded by the world’s #1 hacking team. We were the first team to build an nginx RCE and the first to root Android 17. Our co-founders include members of the world’s No. 1 CTF team, DEF CON winners, Black Hat speakers, and PhD in cybersecurity. We have won $400K in bug bounties by exploiting the Linux kernel and Chrome browser. “Audited by Nebula Security” is a mark of serious security credibility: a signal to customers, investors, and partners that your product has been reviewed by the world’s best hackers.
Founder traction evidence
Public posts and activity attributed directly to this founder.
- X
Reproduced the LPE in 1h 56m on Linux 6.12.96 LTS.
Reproduced the LPE in 1h 56m on Linux 6.12.96 LTS. Also managed to get root on Pixel 10 with the latest 2026-07-05 security update. It was originally submitted by another researcher to Google KernelCTF as exp527 and should qualify for a $101,337 bounty.
- X
IonStack Blog Series: Part I (Firefox SpiderMonkey JIT RCE): https://t.co/PbUJTlFLa2 Part II (GhostLock, a 15 yo universal Linux LPE): https://t.co/TxHv6lBaAd IonStack Part III (Rooting Android with GhostLock): https://t.co/z98lRbnWiH https://t.co/8Jua8aR6OQ
IonStack Blog Series: Part I (Firefox SpiderMonkey JIT RCE): https://t.co/PbUJTlFLa2 Part II (GhostLock, a 15 yo universal Linux LPE): https://t.co/TxHv6lBaAd IonStack Part III (Rooting Android with GhostLock): https://t.co/z98lRbnWiH https://t.co/8Jua8aR6OQ
- X
It seems we won the last LTS slot in kernelCTF history...
It seems we won the last LTS slot in kernelCTF history... might be the last regular $101,337. Our score for the future rankings is 299.855/300. Starting next month, kCTF submissions will have to bypass hardenings like SLAB_VIRTUAL, and the 1-day/LTS will no longer be available
- X
The CVE record says this is a null pointer dereference with, so surely we’re safe :) S:U = Scope Unchanged C:N = Confidentiality: None I:N = Integrity: None Anyway, here’s the exploit for Ubuntu 26.04.
The CVE record says this is a null pointer dereference with, so surely we’re safe :) S:U = Scope Unchanged C:N = Confidentiality: None I:N = Integrity: None Anyway, here’s the exploit for Ubuntu 26.04. It still works on the latest release.
- X
IIRC, this was the last LTS and one of the two COS slots before Google changed kernelCTF's rules and removed the COS target.
IIRC, this was the last LTS and one of the two COS slots before Google changed kernelCTF's rules and removed the COS target. Under the new rules, this bug would worth $101,337.
- X
Extraordinary work! Absolutely love it🤯
Extraordinary work! Absolutely love it🤯
- X
Without SLAB_VIRTUAL, RANDOM_KMALLOC_CACHES alone seems to help very little.
10 year old LPE. Without SLAB_VIRTUAL, RANDOM_KMALLOC_CACHES alone seems to help very little. Fixed upstream in May: https://t.co/vrWUFadcwq But the latest Fedora 44 was released in April, so again mind the gap...
- X
SCTP has the highest proportion of exploitable bugs among our findings! Also, surprisingly, most of them are much easier to exploit than bugs in other submodules (when no special mitigations are enabled).
SCTP has the highest proportion of exploitable bugs among our findings! Also, surprisingly, most of them are much easier to exploit than bugs in other submodules (when no special mitigations are enabled). Luckily, many distros blacklist SCTP by default.