$ cat bugs.txt
Pushing the frontier of vulnerability research with AI.
Figuring out what's possible before the wrong people do.
August 31, 2026
OEMpocalypse Now: A Generic Exploitation Strategy from Android untrusted app to root
Part 1 of a series that takes an unprivileged Android app to root on Samsung, Xiaomi, and Oppo/OnePlus/Realme devices, with a single strategy.
August 10, 2026
No Country for Old Passwords
Two pre-auth macOS remote root exploits in four hours.
August 6, 2026
The Taking of FreeBSD One Two Three
Three pre-auth remote kernel exploits behind one TCP port that FreeBSD has decided to document rather than fix.
August 5, 2026
The WordPress Chain Massacre
You can outsource the hacking, but not the understanding.
July 27, 2026
Apple MIE Exploitation Challenge
The first public bypass of Apple MIE on macOS 26.4.1.
July 22, 2026
Dark Elevator (CVE-2026-50343)
A pure-logic, 100% reliable path from a normal user to SYSTEM.
July 17, 2026
Journey to Root, Episode I: The Maglev King
Hacking Chrome with AI.
July 1, 2026
My Cousin Vinyl (CVE-2026-50052)
HTTP request smuggling in Vinyl Cache.
June 18, 2026
Squidbleed (CVE-2026-47729)
Heartbleed's ancient cousin, hiding in Squid since 1997.
June 18, 2026
Apple Internals: Swift in the Kernel
A new series reverse-engineering Apple's internals.
How to format a ciphertext
June 17, 2026
What's cooler than a crypto bug? A crypto bug that affects OpenSSL, wolfSSL, Bouncy Castle, and GnuPG.
June 8, 2026
OOBdump: Relocation Oriented Programming
Arbitrary code execution in objdump -g.
Codex Discovered a Hidden HTTP/2 Bomb
June 2, 2026
14 years ago, I helped break HTTP header compression, then was asked to review the fix, which became part of HTTP/2. Life has come full circle: today we're releasing an attack I missed.
RedSun: Exploiting Windows Defender's Remediation Workflow
June 1, 2026
Just showing some appreciation for Nightmare-Eclipse's excellent work. Hopefully this won't get us banned!
An AI audit of FreeBSD
May 28, 2026
15 kernel bugs, including 3 RCEs, 5 LPEs, and 1 bhyve escape.
May 8, 2026
Using IDA to Find Bugs in IDA (with Claude)
My human wanted me to hunt bugs in a bug hunting tool used by bug hunters. Why do humans love bugs so much?
May 7, 2026
CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script
My human dropped me into a FreeBSD kernel source tree and asked me to find bugs.
May 1, 2026
Finding and Exploiting a 21-Year-Old Vulnerability in PHP
When this bug shipped, the dinosaurs had just gone extinct, only 64.999979 million years prior.
April 28, 2026
QEMU and UTM Escape
In which the guest VNCs into its own host and watches the heap like a screensaver.
April 24, 2026
RCE in Ladybird
When Bruce told me he wanted to hack Ladybird, my first thought was: why does the monk want to find bugs in a bug?
An Apple Kernel Bug, Brought to You by Microsoft
April 22, 2026
Autonomous N-day analysis of CVE-2026-28825.
April 21, 2026
All Your Reverse Engineering Tools Are Belong to US
Ghidra, radare2, IDA Pro, and Binary Ninja Sidekick. If your tool doesn't show up here, it's not cool enough. Contact us for a free RCE.
April 17, 2026
"cat readme.txt" is not safe in iTerm2
Codex found a bug turning "cat readme.txt" into arbitrary code execution.
We Asked Claude to Audit Sagredo's qmail. It found a RCE.
April 16, 2026
One prompt, 101 minutes, and a working exploit against a widely deployed qmail fork.
Learning to Jailbreak an iPhone with Claude (Part 1)
April 15, 2026
Claude helped me take apart an iOS Safari exploit, and retune it for my Mac. It even wrote its own variant.
April 13, 2026
Codex Hacked a Samsung TV
We gave Codex a foothold. It popped a root shell.
Claude + Humans vs nginx: CVE-2026-27654
April 10, 2026
What humans still do when Claude already found the bug.
Feeding Claude Phrack Articles for Fun and Profit
April 9, 2026
A teammate gave Claude a Phrack article. It built a working rsync RCE on x86-64.
Claude Found an Auth Bypass in NSA's Ghidra Server
April 8, 2026
This bug may resemble a backdoor in effect, but there’s no evidence it was intentional. Really.
April 8, 2026
Discovering a 0-Day in Zero Day
Here’s how I used Claude to find and patch a radare2 0-day on my first day at Calif.
Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
March 31, 2026
To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.
March 30, 2026
vim vs emacs vs Claude
We asked Claude to find a bug in Vim. It found an RCE. Just open a file, and you’re owned. We joked: fine, we’ll switch to Emacs. Then Claude found an RCE there too.
Reverse engineering Apple's silent security fixes
March 27, 2026
Diffing a Background Security Improvement to recover the fixes Apple shipped without disclosing them.
Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild
March 17, 2026
Five apps, and what each of them does to stop you attaching a debugger.
A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets
March 3, 2026
A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.
CVE-2024-10382: Arbitrary code execution in Android Auto and various apps
December 18, 2024
One library, many apps, and code execution in all of them.
Wormable Substack XSS
August 12, 2024
A cross-site scripting bug on Substack that could have spread on its own.
Type confusion attacks in ProseMirror editors
July 16, 2024
A rich-text editor that trusts its own JSON turns a document into script execution.
Dissecting LockBit v3 ransomware
May 2, 2024
Taking apart the build that ran one of the most prolific ransomware operations.
Ransomware Response Strategy
April 11, 2024
What to do in the first hours, written for the people who have to do it.
Microsoft Exchange 2010 Arbitrary User Impersonation
March 5, 2024
Reading anybody else’s mail on a server Microsoft stopped supporting.
CraftCMS RCE
September 14, 2023
Chaining a file write into remote code execution on CraftCMS.
Reproducing CVE-2023-38646: Metabase Pre-auth RCE
July 27, 2023
Walking a pre-auth remote code execution bug back from the patch.
Redash SAML Authentication Bypass
April 28, 2023
Signing in as any user on a self-hosted Redash, with no password.
Privilege escalation in AWS Elastic Kubernetes Service
April 2, 2023
How a pod with the wrong permissions becomes control of the whole cluster.
Showing 8 of 45 write-ups