Nebula Security

NebuSec's vulnerability researchers build Nebu to protect code, software supply chains, and cloud infrastructure.

NebuSec builds Nebu, an AI security platform for continuous code and cloud protection, backed by researchers who find zero-days in Chrome and Linux.

NebuSec collects, uses, and shares information when users use its web application and Google-related services.

The terms govern use of the NebuSec web application and related services.

Nebula Security publishes technical details and exploit code for GhostLock, a Linux kernel use-after-free flaw tracked as CVE-2026-43499 that has existed since 2011 and yields local root access. The team demonstrates a container escape in Google kernelCTF and receives a $92,337 bug bounty.

Jul 2026 · SecurityWeekNews article

Nebula Security discloses IonStack, a one-click exploit chain that gives attackers root access to fully updated Android 17 devices through a single malicious link. It combines browser flaw CVE-2026-10702 with the GhostLock kernel flaw CVE-2026-43499 to escape the browser sandbox and gain full root privileges.

Jul 2026 · Nomid MDMNews article

Nebula Security researchers disclose GhostLock, a Linux kernel flaw tracked as CVE-2026-43499. The 15-year-old vulnerability lets local users gain root control and escape containers on most Linux distributions. The team reports a 97%-reliable exploit, a $92,337 Google kernelCTF bounty, and publishes working exploit code.

Jul 2026 · The Hacker NewsNews article

Nebula Security unveils IonStack, the first public Android 17 root exploit chain, which compromises a device after a single click on a malicious URL. The chain combines a Firefox zero-day with a nearly 15-year-old Linux kernel flaw, both discovered by the VEGA automated scanning agent, to move from browser sandbox access to full kernel control.

Jul 2026 · Expert in the CloudNews article