With all these exploits flying around on the internet I think we should all switch to HTTP 4.0, which I would like to propose here: HTTP 4.0: Human hand-To-hand Transfer Protocol A post-apo protocol where you just hand your friend your website on a pendrive/CD/floppy/tape. You MUST first check if they are not a replicant of course.

I think this team of hackers might be cracked. Calif is the same team behind the PHP vuln. iPhone duo jailbreak on release day is wild.

Software is insecure and we have not fixed THAT FACT in 25+ years. Our solution has always to just shoot the messenger. Vendors going after researcher openly or in private. Inventing RESPONSIBLE DISCLOSURE. And now we do it again by shooting at LLM with crippling safeguards.

The @UnpromptedAU videos came out recently. Check out my ramble about AI assisted exploit development unprompted.au/videos/ai-assi…

Vietnamese rulez!

I just remembered why Brotli looked vaguely familiar: I worked on it at Google. I even co-authored an RFC [1]. Hopefully they haven't found my bugdoor 😅 Joking aside, CRIME [2] led me to work on things like Brotli and HPACK, the header compression scheme used in HTTP/2. That was the magic of working at Google. They operated at such a huge scale that a few weeks of your work could become part of a widely used Internet standard. One of my fondest memories is helping audit QUIC and writing little bits of crypto code for it. Before I left Google, a teammate on the Tink [3] team told me he believed Tink would last 50 years, outliving everyone on the team. Tink is now in its 10th year. 40 more to go! I also learned that breaking things is fun, but lasting contribution often comes from building things that make the Internet faster and safer. That same belief shapes much of our work at Calif. People know us for our offensive security research, but we've also done a lot of security engineering to harden systems and mitigate attacks, from large-scale Rust migrations to fast sandboxing or reducing zero-click attack surface in mobile apps. We'll be sharing some of that work soon. Stay tuned! [1] rfc-editor.org/rfc/rfc9841.t… [2] en.wikipedia.org/wiki/CRIME [3] github.com/tink-crypto

CC @pwnlambda

No. We published complete addition formulas for NIST P-256 etc. in 2009: cr.yp.to/talks/2009.07.17/sl… We posted the SafeCurves criteria in 2013, including requiring _fast_ complete formulas, and said why this mattered: web.archive.org/web/20131019…. Your purported "change" never happened.

Omg I found a copy of the original memory_limit advisory. marc.info/?l=bugtraq&m=10898…

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

Woot! the @unpromptedau talks are starting to coming come online! 👀 This one by @moyix was probably my favorite: 15mins of unadulterated old-school “I’m hacking this because I think I can” followed by a one-shot live exploit demo involving a t-shirt with a cat on it worn by @mdowd. Seriously just go watch it (and subscribe for the others… More on the way!) Watch Brendan Dolan-Gavitt: Security Through Obscurity Is Dead and LLMs Killed It unprompted.au/videos/securit…

Calif was founded with a mission to make the Internet a more secure place for everyone. In the last few months, we have been seeing significant advances in AI model capabilities, especially in the domain of offensive security research. In addition to publishing our research and learnings, we wondered what else we could do to help defenders. While large corporations and government agencies have the dedicated budget and human resources for incident response and forensics, there are non-profit organizations –- collectively known as civil society organizations –- investigating digital threats affecting vulnerable groups and they are funded entirely by volunteers. In order to perform their job, the civil society researchers may need to extract data from mobile devices for forensic purposes, reverse engineer malware, and conduct similar security tasks. This work can be challenging given the restricted environments on some mobile devices. We understand these technical challenges and will offer our research services and capabilities to these organizations, free of charge. We support them and their mission. If you represent such an organization and need assistance, contact us at help@calif.io.

This used to be "Curve25519 has complete addition". Then it was found that NIST curves also have "complete addition", so the narrative had changed to "easy". joostrenes.nl/publications/c…

Giving credit where it's due, this work by Calif is among the most impressive I've ever seen published with LLMs for VR.

The 21-year marketing campaign for Curve25519 came to an abrupt end today.

4/ APT stands for Apple Persistent Threat

3/ Can your iPhone do this?

2/ But who cares about a third-party app when everyone uses iMessage, right?

Demos we presented at Hexacon in Paris today. Everything will be released in due time. 1/ Signal 1-click

At #hexacon - Calif.io demos iOS 27.0.1 untethered jailbreak on iPhone 18 Pro