An AI defense system for cyber attack
The power dynamic just shifted back to the defenders.
Book a demo
Backed by
Combinator
From the world’s #1 hacking team.
Nebu watches your code and cloud around the clock. When it’s serious, the same team that’s found zero-days in Chrome and the Linux kernel steps in. Don’t let a breach be your first audit.
1178+
Vulnerabilities found
197+
CVEs assigned
Security vulnerabilities identified, verified, and officially recognized.
CVE-2026-43499
197+
CVEs assigned
Security vulnerabilities identified, verified, and officially recognized.
CVE-2026-43499
$400K+
VRP bounties
Latest findings
- HOTCVE-2026-43499 — The world's first Android 17 root exploit
- HOTCVE-2026-5865 — Maglev JIT phi-untagging bug → remote code execution
- HOTCVE-2026-42530 — nginx-quicburst: the world's first default config nginx RCE exploit
- CVE-2026-8924 — super-cookie PSL bypass leaks cookies to unrelated domains
- HOTCVE-2026-10702 — IonStack: Full chain browser-to-kernel Android 17 root exploit
Security that meets your team where it is.
Code Security
Continuous codebase monitoring, verified findings, and patches ready to merge.
Coming soonSupply Chain Security
Secure the dependencies, build pipelines, and releases you rely on.
Coming soonCloud Security
Continuous visibility and control across cloud infrastructure, identities, and configurations.
Coming soonAI Pentesting
Continuous pentesting keeps your security posture up to date.
One platform for continuous security
Autonomous vulnerability scan
Every code change gets a comprehensive vulnerability scan with full repository context.
- Scan each code change
- Full repository context
Latest AI breakthrough research from NebuSec
View all research
Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon
Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF
IonStack part III: Rooting Android 17 with GhostLock
IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
Security built for enterprise engineering teams
NebuSec was founded by the researchers who discovered zero-days in Chrome, Firefox, and the Linux kernel. We combine deep vulnerability research with AI to protect your codebase continuously.
Follow us
