The Curious Engineer

All blogs / Security

Calif

calif.io

Calif secures the AI you use every day. Red teaming and security engineering from the hackers trusted by OpenAI, Anthropic, Google, Cursor and xAI.

SecurityReverse engineeringOS / kernel

’23’24’25’26
Posts
70 from 2 Apr 2023 to 21 Oct 2026
Posting
weekly (55 in the last year)
Kind
company blog

2026 55

  1. PHP2Shell by Calif Research
  2. Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
  3. madbugs research
  4. openbsd research
  5. apple research
  6. CVE-2026-86950: The Great Glyph Grift
  7. zero-click research
  8. Apple Internals: Endpoint Security ships in iOS 27.2 beta
  9. android research
  10. Weworm
  11. OEMpocalypse Now: A Generic Exploitation Strategy from Android untrusted app to root
  12. Password Fiction
  13. freebsd research
  14. The Taking of FreeBSD One Two Three
  15. linux research
  16. The WordPress Chain Massacre
  17. Apple MIE Exploitation Challenge
  18. Dark Elevator (CVE-2026-50343)
  19. windows research
  20. chrome research
  21. Journey to Root, Episode I: The Maglev King
  22. My Cousin Vinyl (CVE-2026-50052)
  23. Apple Internals: Swift in the Kernel
  24. Squidbleed (CVE-2026-47729)
  25. How to format a ciphertext
  26. crypto research
  27. OOBdump: Relocation Oriented Programming
  28. Read the research →
  29. Codex Discovered a Hidden HTTP/2 Bomb
  30. RedSun: Exploiting Windows Defender's Remediation Workflow
  31. An AI audit of FreeBSD
  32. Using IDA to Find Bugs in IDA (with Claude)
  33. reversing research
  34. CVE-2026-7270: How I Get Root on FreeBSD with a Shell Script
  35. php research
  36. Finding and Exploiting a 21-Year-Old Vulnerability in PHP
  37. QEMU and UTM Escape
  38. RCE in Ladybird
  39. An Apple Kernel Bug, Brought to You by Microsoft
  40. All Your Reverse Engineering Tools Are Belong to US
  41. "cat readme.txt" is not safe in iTerm2
  42. We Asked Claude to Audit Sagredo's qmail. It found a RCE.
  43. Learning to Jailbreak an iPhone with Claude (Part 1)
  44. safari research
  45. samsung research
  46. Codex Hacked a Samsung TV
  47. Claude + Humans vs nginx: CVE-2026-27654
  48. Feeding Claude Phrack Articles for Fun and Profit
  49. Claude Found an Auth Bypass in NSA's Ghidra Server
  50. Discovering a 0-Day in Zero Day
  51. Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
  52. vim vs emacs vs Claude
  53. Reverse engineering Apple's silent security fixes
  54. Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild
  55. A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets

2024 8

  1. CVE-2024-10382: Arbitrary code execution in Android Auto and various apps
  2. Wormable Substack XSS
  3. web research
  4. Type confusion attacks in ProseMirror editors
  5. Dissecting LockBit v3 ransomware
  6. ransomware research
  7. Ransomware Response Strategy
  8. Microsoft Exchange 2010 Arbitrary User Impersonation

2023 5

  1. CraftCMS RCE
  2. Reproducing CVE-2023-38646: Metabase Pre-auth RCE
  3. Redash SAML Authentication Bypass
  4. cloud research
  5. Privilege escalation in AWS Elastic Kubernetes Service

Undated 2

  1. Company
  2. Jobs