R—01
READ ↗PUBLIC NOTES ON iOS SECURITY
iossec.tech
HSE STUDENT / IOS VULNERABILITY RESEARCHER
A
Low-level vulnerability research across iOS — from kernel internals to system services.
CURRENTLY
Vladislav Shevchenko is a fourth-year Information Security student at HSE University and an iOS vulnerability researcher at Positive Technologies. His work spans kernel internals, Apple Neural Engine, M2Scaler, and platform mitigations.
Selected
findings.
Public write-ups, PoCs and root-cause analyses. The complete collection lives in CaseStudies ↗
R—02
Apple-Credited / ANE / Kernel Memory Safety
READ ↗CVE-2026-43748 — Kernel heap OOB write in the ANE direct path
PoCs and root-cause analysis for CVE-2026-43748 in ANE_ProgramCheckandPrewireBuffers_gated.
R—03
Apple-Credited / iOS Kernel / DTrace
READ ↗CVE-2026-39868 — Kernel memory corruption in DTrace DOF helper parsing
Malformed lazy DOF sections, integer overflows, and a confused-deputy path into fasttrap qsort.
R—04
Apple-Credited / IOKit / Information Disclosure
READ ↗CVE-2026-65371 — Kernel address leak in IOService::updateConsoleUsers
A gRegistryRoot kernel address reaches user space through console-security interest notifications.
R—05
AppleM2Scaler / MTE
READ ↗IOSurface KVA and MTE-tag disclosure
An unsanitized diagnostic-log payload exposes a chosen IOSurface address and its MTE tag.
R—06
CVE / Sandbox Escape
READ ↗Sandbox escape via c.a.f.netfs.PlugInLibraryService
Unsandboxed NetFS plugin loading via path traversal and CFPlugIn abuse.
R—07
dyld4 / Bug Note
READ ↗Bug in dyld4::setUpPageInLinkingRegions
A TPRO-stack overflow edge case in dyld4::setUpPageInLinkingRegions.
How I move through
millions of lines.
A mix of open-source tools I host or adapt, plus custom infrastructure built around day-to-day iOS research.
U—01
ELIXIR / HOSTED
cs.iossec.tech
Hosted Elixir Code Search for the iOS kernel and dyld, with a few local tweaks.
↗U—02ZOEKT / HOSTED
zoekt.iossec.tech
A hosted Zoekt instance for fast regex search across iOS kernel source.
↗U—03CUSTOM / CRASH INTAKE
panic.iossec.tech
A custom receiver for collecting iOS crash reports and kernel panics.
↗POSTSCRIPT / 00
Found something
strange?
Feel free to DM me through whichever channel works best for you.