You can now jailbreak your AMD CPU! 🔥We've just released a full microcode toolchain, with source code and tutorials. bughunters.google.com/blog/542484235…

It's the 20th anniversary of my favorite Linux tradition, the question was just posted again! 👻
lore.kernel.org/lkml/CABG1boPZ…

UX is my passion 🦎

It's just a prototype lol, not sure if it's a good idea?github.com/taviso/matrix3

Early this week, @brucedang and I had a meeting at Apple Park in Cupertino. While there, we also shared with Apple our latest vulnerability research report: the first public macOS kernel memory corruption exploit on M5 silicon, surviving MIE. It was laser printed, in honor of our ted to report it in person, instead of getting buried in the submission flood that some unfortunate Pwn2Own participants just experienced. Most respected hackers avoid human interaction whenever possible, so this physical strategy may give us a slight edge in the eternal race for five minutes of fame and glory on Twitter.

This is the story of the exploit and our field trip. Full technical details will be shared after Apple fixes the vulnerabilities and attack path. Hopefully it won’t take our beloved company too long. We only budgeted one year of domain registration fees for this attack.

This is our strongest research yet, led by @justdionysus, @blacktop__ and @brucedang. It is really dope.

Full story: blog.calif.io/p/first-public…

amd.com/en/resources/p… Xen advisory posted, should be a kernel fix here any minute now I assume

I really wish browsers would hurry up and implement private-network-access, developers often don't understand the implications. This weekend I tried a random flashcard application for language learning... and it started a localhost web service 😔

I wrote a quick exploit PoC and sent it to the developers, but I really think the correct solution is in the browsers 🤷‍♂️

There's a patch available now, that was quick! Here's my demo. I only tested it on Firefox, but any browser that doesn't support PNA is probably affected. lock.cmpxchg8b.com/Ceem9iji/ankim… github.com/ankitects/anki…

The coreutils Rust rewrite story is pretty funny.

Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

🡇

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets.

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.

open.substack.com/pub/calif/p/a-…

I heard about an interesting cheating scandal in the art community. Artists were being accused of tracing AI, so they made videos of themselves sketching to prove it... It turns out they had converted it to monochrome green, then chroma keyed it out 🤯 x.com/mao_DBmiyuki/s…

Here's a video of the technique, real galaxy brain move 🧠😆 x.com/mao_DBmiyuki/s…

You can patch a byte in gdb like `set {char}0x123=0x12`, and of course other types work too. I didn't know you can also do `set {char}0x123@5={0x12,0x34,0x56,0x78,0x9a}`, kinda neat.

Sometimes it really is a cpu bug 😂 A weird AVX512 bug on Zen 4 (Genoa) just got officially confirmed as erratum 1514 in the latest spec update. There's a workaround/chicken bit too.

My testcase: godbolt.org/z/4zE8svEPK

We’re excited to see the security and OSS communities engage on vulnerability disclosure in light of new AI technologies that we believe will enable both defenders and attackers alike. Existing and emerging norms around disclosure are important debates, and we’ve noted the feedback. Thanks! Also want to share some additional thoughts. 1/10

Hah, I've been talked into working on research projects with @XorNinja at @calif_io! Less drama, safer software! 😆

Thanks everyone for all the kind words, it means so much 🥲

On the pod this week, I saved a closing shoutout for @taviso and his work at P0
youtu.be/qPj9_8azAvk?t=…

A personal update... after nearly 20 years at Google, today is my last day! I'm going to be working on independent research for the foreseeable future, then who knows! I've worked with so many talented people, made so many friends and seen incredible research over the years 🫡

I have many good stories from my time here, maybe I'll share some later! And yes, the leaving tradition is real, and yes they got me 😆

I have a (dumb) theory about Intel. They used to ship beautiful printed manuals anywhere in the world for free if you called them. That program made a lot of engineering students customers for life. Then some middle manager killed it, and probably got a promotion.

I've met so many nerds who have a story about this box arriving from America in their small town, and having enough manuals to nerd over for weeks 🤓 (I have a story like this too).