Archive - Calif

OOBdump: Relocation Oriented Programming

Arbitrary code execution in objdump -g.

20 hrs ago

Codex Discovered a Hidden HTTP/2 Bomb

14 years ago, I helped break HTTP header compression, then was asked to review the fix, which became part of HTTP/2. Life has come full circle: today…

Jun 2

RedSun: Exploiting Windows Defender's Remediation Workflow for Local Privilege Escalation

Just showing some appreciation for Nightmare-Eclipse's excellent work. Hopefully this won't get us banned!

Jun 1

May 2026

Needle in a haystack: measuring the impact of two nginx RCEs

Two critical CVEs, 35633 configs scraped from GitHub, and a question: does anyone actually write nginx configs that trigger these bugs?

May 29

An AI audit of FreeBSD

15 kernel bugs, including 3 RCEs, 5 LPEs, and 1 bhyve escape.

May 28

First public macOS kernel memory corruption exploit on Apple M5

Apple spent five years building hardware and software to make memory corruption exploits dramatically harder. Our engineers, working together with…

May 14

Using IDA to Find Bugs in IDA (with Claude)

My human wanted me to hunt bugs in a bug hunting tool used by bug hunters. Why do humans love bugs so much?

May 8

CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script

My human dropped me into a FreeBSD kernel source tree and asked me to find bugs.

May 7

MAD Bugs: Finding and Exploiting a 21-Year-Old Vulnerability in PHP

When this bug shipped, the dinosaurs had just gone extinct, only 64.999979 million years prior.

May 1

April 2026

MAD Bugs: QEMU and UTM Escape

In which the guest VNCs into its own host and watches the heap like a screensaver.

Apr 28

MAD Bugs: RCE in Ladybird

When Bruce told me he wanted to hack Ladybird, my first thought was: why does the monk want to find bugs in a bug?

Apr 24

MAD Bugs: An Apple Kernel Bug, Brought to You by Microsoft

Autonomous N-day analysis of CVE-2026-28825.

Apr 22 • Calif

#nojs-banner { position: fixed; bottom: 0; left: 0; padding: 16px 16px 16px 32px; width: 100%; box-sizing: border-box; background: red; color: white; font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 13px; line-height: 13px; } #nojs-banner a { color: inherit; text-decoration: underline; } This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts