Calif Research and Art

October 16, 2026

Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

Big fish. Small counter. Root shell.

September 30, 2026

CVE-2026-86950: The Great Glyph Grift

An in-the-wild iOS bug with a possible WhatsApp zero-click path.

September 18, 2026

Apple Internals: Endpoint Security ships in iOS 27.2 beta

Is antivirus coming to iPhone?

September 8, 2026

WeWorm

The first zero-click worm to spread through WeChat calls across iOS and Android.

August 31, 2026

OEMpocalypse Now: A Generic Exploitation Strategy from Android untrusted app to root

Part 1 of a series that takes an unprivileged Android app to root on Samsung, Xiaomi, and Oppo/OnePlus/Realme devices, with a single strategy.

August 10, 2026

Password Fiction

Two pre-auth macOS remote root exploits in four hours.

August 6, 2026

The Taking of FreeBSD One Two Three

Three pre-auth remote kernel exploits behind one TCP port that FreeBSD has decided to document rather than fix.

August 5, 2026

The WordPress Chain Massacre

You can outsource the hacking, but not the understanding.

July 27, 2026

Apple MIE Exploitation Challenge

The first public bypass of Apple MIE on macOS 26.4.1.

July 22, 2026

Dark Elevator (CVE-2026-50343)

A pure-logic, 100% reliable path from a normal user to SYSTEM.

July 17, 2026

Journey to Root, Episode I: The Maglev King

Hacking Chrome with AI.

July 1, 2026

My Cousin Vinyl (CVE-2026-50052)

HTTP request smuggling in Vinyl Cache.

June 18, 2026

Squidbleed (CVE-2026-47729)

Heartbleed's ancient cousin, hiding in Squid since 1997.

June 18, 2026

Apple Internals: Swift in the Kernel

A new series reverse-engineering Apple's internals.

June 17, 2026

How to format a ciphertext

What's cooler than a crypto bug? A crypto bug that affects OpenSSL, wolfSSL, Bouncy Castle, and GnuPG.

June 8, 2026

OOBdump: Relocation Oriented Programming

Arbitrary code execution in objdump -g.

June 2, 2026

Codex Discovered a Hidden HTTP/2 Bomb

14 years ago, I helped break HTTP header compression, then was asked to review the fix, which became part of HTTP/2. Life has come full circle: today we're releasing an attack I missed.

June 1, 2026

RedSun: Exploiting Windows Defender's Remediation Workflow

Just showing some appreciation for Nightmare-Eclipse's excellent work. Hopefully this won't get us banned!

May 28, 2026

An AI audit of FreeBSD

15 kernel bugs, including 3 RCEs, 5 LPEs, and 1 bhyve escape.

May 8, 2026

Using IDA to Find Bugs in IDA (with Claude)

My human wanted me to hunt bugs in a bug hunting tool used by bug hunters. Why do humans love bugs so much?

May 7, 2026

CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script

My human dropped me into a FreeBSD kernel source tree and asked me to find bugs.

May 1, 2026

Finding and Exploiting a 21-Year-Old Vulnerability in PHP

When this bug shipped, the dinosaurs had just gone extinct, only 64.999979 million years prior.

April 28, 2026

QEMU and UTM Escape

In which the guest VNCs into its own host and watches the heap like a screensaver.

April 24, 2026

RCE in Ladybird

When Bruce told me he wanted to hack Ladybird, my first thought was: why does the monk want to find bugs in a bug?

April 22, 2026

An Apple Kernel Bug, Brought to You by Microsoft

Autonomous N-day analysis of CVE-2026-28825.

April 21, 2026

All Your Reverse Engineering Tools Are Belong to US

Ghidra, radare2, IDA Pro, and Binary Ninja Sidekick. If your tool doesn't show up here, it's not cool enough. Contact us for a free RCE.

April 17, 2026

"cat readme.txt" is not safe in iTerm2

Codex found a bug turning "cat readme.txt" into arbitrary code execution.

April 16, 2026

We Asked Claude to Audit Sagredo's qmail. It found a RCE.

One prompt, 101 minutes, and a working exploit against a widely deployed qmail fork.

April 15, 2026

Learning to Jailbreak an iPhone with Claude (Part 1)

Claude helped me take apart an iOS Safari exploit, and retune it for my Mac. It even wrote its own variant.

April 13, 2026

Codex Hacked a Samsung TV

We gave Codex a foothold. It popped a root shell.

April 10, 2026

Claude + Humans vs nginx: CVE-2026-27654

What humans still do when Claude already found the bug.

April 9, 2026

Feeding Claude Phrack Articles for Fun and Profit

A teammate gave Claude a Phrack article. It built a working rsync RCE on x86-64.

April 8, 2026

Claude Found an Auth Bypass in NSA's Ghidra Server

This bug may resemble a backdoor in effect, but there’s no evidence it was intentional. Really.

April 8, 2026

Discovering a 0-Day in Zero Day

Here’s how I used Claude to find and patch a radare2 0-day on my first day at Calif.

March 31, 2026

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.

March 30, 2026

vim vs emacs vs Claude

We asked Claude to find a bug in Vim. It found an RCE. Just open a file, and you’re owned. We joked: fine, we’ll switch to Emacs. Then Claude found an RCE there too.

March 27, 2026

Reverse engineering Apple's silent security fixes

Diffing a Background Security Improvement to recover the fixes Apple shipped without disclosing them.

March 17, 2026

Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild

Five apps, and what each of them does to stop you attaching a debugger.

March 3, 2026

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.