Calif
Subscribe
Sign in
Home
Visit Calif
MAD Bugs
Archive
About
MADBugs
Latest
Top
Discussions
The Taking of FreeBSD One Two Three
Three pre-auth remote kernel exploits behind one TCP port that FreeBSD has decided to document rather than fix.
Aug 6
6
The WordPress Chain Massacre
You can outsource the hacking, but not the understanding
Aug 5
5
Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343)
A pure-logic, 100% reliable path from a normal user to SYSTEM
Jul 22
•
r0keb
10
Journey to Root, Episode I: The Maglev King
Hacking Chrome with AI
Jul 17
•
Duc Phan
,
Quang Luong
, and
Tuan
12
4
MAD Bugs: My Cousin Vinyl (CVE-2026-50052)
So the story went like this: Squid was bleeding from a 29-year-old heap overread in her default config.
Jul 1
•
Jun Rong
11
2
Squidbleed (CVE-2026-47729)
Heartbleed's ancient cousin, hiding in Squid since 1997.
Jun 18
8
5
1
How to format a ciphertext
What's cooler than a crypto bug? A crypto bug that affects OpenSSL, wolfSSL, Bouncy Castle, and GnuPG.
Jun 17
•
Thai Duong
10
4
1
OOBdump: Relocation Oriented Programming
Arbitrary code execution in objdump -g.
Jun 8
5
1
Codex Discovered a Hidden HTTP/2 Bomb
14 years ago, I helped break HTTP header compression, then was asked to review the fix, which became part of HTTP/2. Life has come full circle: today…
Jun 2
35
13
6
An AI audit of FreeBSD
15 kernel bugs, including 3 RCEs, 5 LPEs, and 1 bhyve escape.
May 28
17
2
First public macOS kernel memory corruption exploit on Apple M5
Apple spent five years building hardware and software to make memory corruption exploits dramatically harder. Our engineers, working together with…
May 14
104
1
9
Using IDA to Find Bugs in IDA (with Claude)
My human wanted me to hunt bugs in a bug hunting tool used by bug hunters. Why do humans love bugs so much?
May 8
11
2
1
This site requires JavaScript to run correctly. Please
turn on JavaScript
or unblock scripts
