The Curious Engineer

All blogs / Security

Calif Newsletter

blog.calif.io

Click to read Calif Newsletter, a Substack publication with thousands of subscribers.

SecurityWindows internalsReverse engineering

’23’24’25’26
Posts
63 from 1 Apr 2023 to 16 Oct 2026
Posting
weekly (40 in the last year)
Kind
company blog
Feed
https://blog.calif.io/feed

2026 40

  1. Iphone
  2. WeWorm is calling. It's time to answer.
  3. Weworm
  4. OEMpocalypse Now
  5. No Country for Old Passwords
  6. The Taking of FreeBSD One Two Three
  7. The WordPress Chain Massacre
  8. Apple MIE exploitation challenge
  9. Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343)
  10. Journey to Root, Episode I: The Maglev King
  11. MAD Bugs: My Cousin Vinyl (CVE-2026-50052)
  12. Squidbleed (CVE-2026-47729)
  13. Apple Internals: Swift in the Kernel
  14. How to format a ciphertext
  15. OOBdump: Relocation Oriented Programming
  16. Codex Discovered a Hidden HTTP/2 Bomb
  17. RedSun: Exploiting Windows Defender's Remediation Workflow for Local Privilege Escalation
  18. Needle in a haystack: measuring the impact of two nginx RCEs
  19. An AI audit of FreeBSD
  20. First public macOS kernel memory corruption exploit on Apple M5
  21. Using IDA to Find Bugs in IDA (with Claude)
  22. CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script
  23. MAD Bugs: Finding and Exploiting a 21-Year-Old Vulnerability in PHP
  24. MAD Bugs: QEMU and UTM Escape
  25. MAD Bugs: RCE in Ladybird
  26. MAD Bugs: An Apple Kernel Bug, Brought to You by Microsoft
  27. MAD Bugs: All Your Reverse Engineering Tools Are Belong to US
  28. MAD Bugs: "cat readme.txt" is not safe in iTerm2
  29. We Asked Claude to Audit Sagredo's qmail. It found a RCE.
  30. Learning to Jailbreak an iPhone with Claude (Part 1)
  31. Codex Hacked a Samsung TV
  32. Claude + Humans vs nginx: CVE-2026-27654
  33. MAD Bugs: Feeding Claude Phrack Articles for Fun and Profit
  34. MAD Bugs: Claude Found an Auth Bypass in NSA's Ghidra Server
  35. MAD Bugs: Discovering a 0-Day in Zero Day
  36. MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
  37. MAD Bugs: vim vs emacs vs Claude
  38. Reverse engineering Apple’s silent security fixes
  39. Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild
  40. A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets

2025 6

  1. A history of device-bound cookies
  2. “Vibe Hacking”: Abusing Developer Trust in Cursor and VS Code Remote Development
  3. Partnering with Google to Strengthen Open-Source Crypto: An Mbed TLS Security Audit
  4. Oracle SSO, SOS
  5. YouTube Threat Modeling
  6. Calif Ski Team

2024 10

  1. CVE-2024-10382: Arbitrary code execution in Android Auto and various apps
  2. What we do when we aren't hacking you
  3. Building new hospitals in Vietnam
  4. Wormable Substack XSS
  5. Type confusion attacks in ProseMirror editors
  6. Dissecting LockBit v3 ransomware
  7. Ransomware Response Strategy
  8. Microsoft Exchange 2010 Arbitrary User Impersonation
  9. A trip to the White House
  10. Argo CD CSRF

2023 7

  1. Improving AI Safety with Red Teaming
  2. US Offsite Summer 2023
  3. CraftCMS RCE
  4. Reproducing CVE-2023-38646: Metabase Pre-auth RCE
  5. Redash SAML Authentication Bypass
  6. Privilege escalation in AWS Elastic Kubernetes Service
  7. Fantastic Crypto Bugs and Where to Find Them