Tcademy LA CTF 2026 Heap Tcache-Poisoning House-of-Apple-2 Libc-Got Pwn Heap exploitation on glibc 2.35: integer underflow to massive heap overflow, and two paths to shell: libc GOT overwrite or House of Apple 2 FSOP.
AHC - Average Heap Challenge PascalCTF 2026 Heap Tcache Chunk-Size-Corruption Pwn Tcache bin confusion via chunk size corruption.
Velvet Table UMD CTF 2026 Heap Smallbin-Attack Tcache-Poisoning Safe-Linking Uaf Obfuscation Pwn Glibc 2.32+ heap note manager wrapped in heavy XOR obfuscation. An inverted size check in the cashout handler turns the dev’s careful tcache bookkeeping into a free UAF, with a slightly longer smallbin attack waiting behind it as the intended path.