Calif

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.

Mar 31 • Calif

14

3

1

MAD Bugs: vim vs emacs vs Claude

We asked Claude to find a bug in Vim. It found an RCE. Just open a file, and you’re owned. We joked: fine, we’ll switch to Emacs. Then Claude found an…

Mar 30 • Calif

26

6

3

Reverse engineering Apple’s silent security fixes

I grabbed the latest iOS update, and diffed it with ipsw. The diff reveals at least two security-relevant changes that were shipped quietly.

Mar 27

5

Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild

Table Of Contents

Mar 17 • Calif

17

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool…

Mar 3 • Calif

25

3

7

August 2025

A history of device-bound cookies

The recent announcement from Google about Device Bound Session Credentials (DBSC) sent me down memory lane.

Aug 24, 2025 • Thai Duong

7

“Vibe Hacking”: Abusing Developer Trust in Cursor and VS Code Remote Development

Update: Mauro Soria pointed out that this attack vector can be easily adapted for phishing scenarios:

Aug 18, 2025

19

1

July 2025

Partnering with Google to Strengthen Open-Source Crypto: An Mbed TLS Security Audit

By Linh Le and Ngan Nguyen

Jul 5, 2025

6

April 2025

Oracle SSO, SOS

You've probably seen the news: Oracle Cloud got popped, exposing 6 million records from over 140,000 tenants.

Apr 8, 2025 • Thai Duong

11

1

March 2025

YouTube Threat Modeling

Last week, we delivered our first training session with YouTube engineers on the attacker's mindset and threat modeling.

Mar 25, 2025 • Thai Duong

12

January 2025

Calif Ski Team

In Vietnam, we have three seasons: hot, hotter, and damn hot!

Jan 2, 2025 • Thai Duong

6

December 2024

CVE-2024-10382: Arbitrary code execution in Android Auto and various apps

In July 2024, Google engaged Calif to audit Android Automotive OS (AAOS) and Android Auto.

Dec 18, 2024 • Khanh and Linhlhq

10

2

2