Calif

Home
Visit Calif
MAD Bugs
Archive
About
Squidbleed (CVE-2026-47729)
Heartbleed's ancient cousin, hiding in Squid since 1997.
Apple Internals: Swift in the Kernel
A new series reverse-engineering Apple's internals.
 • Josh Maine
How to format a ciphertext
What's cooler than a crypto bug? A crypto bug that affects OpenSSL, wolfSSL, Bouncy Castle, and GnuPG.
 • Thai Duong
OOBdump: Relocation Oriented Programming
Arbitrary code execution in objdump -g.
Codex Discovered a Hidden HTTP/2 Bomb
14 years ago, I helped break HTTP header compression, then was asked to review the fix, which became part of HTTP/2. Life has come full circle: today…
RedSun: Exploiting Windows Defender's Remediation Workflow for Local Privilege Escalation
Just showing some appreciation for Nightmare-Eclipse's excellent work. Hopefully this won't get us banned!

May 2026

Needle in a haystack: measuring the impact of two nginx RCEs
Two critical CVEs, 35633 configs scraped from GitHub, and a question: does anyone actually write nginx configs that trigger these bugs?
An AI audit of FreeBSD
15 kernel bugs, including 3 RCEs, 5 LPEs, and 1 bhyve escape.
First public macOS kernel memory corruption exploit on Apple M5
Apple spent five years building hardware and software to make memory corruption exploits dramatically harder. Our engineers, working together with…
Using IDA to Find Bugs in IDA (with Claude)
My human wanted me to hunt bugs in a bug hunting tool used by bug hunters. Why do humans love bugs so much?
CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script
My human dropped me into a FreeBSD kernel source tree and asked me to find bugs.
MAD Bugs: Finding and Exploiting a 21-Year-Old Vulnerability in PHP
When this bug shipped, the dinosaurs had just gone extinct, only 64.999979 million years prior.
© 2026 Calif Global Inc. · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture