Calif

A fun little weekend project. Hey Rivian, check your inbox. We sent you a few cool bugs last week.

Today, we're publishing WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. One call is enough. The victim doesn't need to answer or interact with their phone. Within seconds, WeWorm can take over their WeChat account and use it to call their friends, spreading from phone to phone. If exploited, actors can compromise over a billion phones (or accounts), upending livelihoods and breaking communities worldwide. Working with AI, our team found the bug and wrote the first RCE exploit in about two days. We reported it to Tencent, and our exploit has now been mitigated for all users. We hope this work sets an example for what responsible AI-powered security research can achieve. It is a call for the United States, China, and other governments to work together and collaborate with private industry on developing and deploying AI to make the world safer for everyone. Our research + demos: https://lnkd.in/gTvAK4QH The New York Times also followed our work and published their story today: https://archive.is/arHsF

A big thank you to Calif for supporting unprompted.au 2026. Bringing deep technical expertise, a strong research focus and one of their own team to the unprompted.au stage. Proud to have their support on and off the stage!

New research: OEMpocalypse Now! Our own Lukas Maar spent a few weeks pursuing one question: How do you turn a normal Android app into root access across as many phones as possible without rewriting the exploit for every model? Generic Linux kernel bugs offer broad coverage: one exploit can target both Pixel and Galaxy. But bugs that survive years of auditing often provide only constrained slab-level primitives, forcing the exploit into heap grooming and per-device tuning. Chipset drivers offer stronger primitives. A GPU or DSP driver pins and maps entire pages for the device, giving the attacker page-level access. But coverage follows the silicon, and each OEM ships several chipsets across its lineup. Lukas chose a third target: the code Samsung, Xiaomi, and Oppo build on top of Android. These components belong to One UI, HyperOS, and ColorOS rather than the underlying hardware, so they span an OEM's lineup regardless of chipset. The strategy exploits a page use-after-free in an OEM kernel driver. If SELinux restricts the driver to a privileged domain, an OEM sandbox escape reaches it first. A stale mapping to a freed physical page bypasses much of Android's kernel hardening. It requires no KASLR leak and hijacks no control flow, leaving slab protections and CFI irrelevant. The same page-reclamation code worked unchanged from kernels 5.15 through 6.12. Lukas built the chain three times, once for each OEM. The exploits run on a Galaxy S26 Ultra, Galaxy S26, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra, all running stock July 2026 firmware with locked bootloaders. The write-up includes demo videos. Part 1 explains the strategy, its reasoning, and its tradeoffs. Parts 2 through 4 present each OEM-specific chain. Read it at https://lnkd.in/gg2-BZjR.

In our inaugural "Meet the Hackers" episode, we hosted the GOAT of browser exploitation, Samuel Groß (https://x.com/5aelo). For the second episode, we are excited to host the GOAT of iOS exploitation: Brandon Azad (https://www.x.com/_bazad). Like Samuel, Brandon needs no introduction. If you are doing iOS/macOS hacking, you have likely used or read his code; even famous iOS malware authors use his stuff. He will give a talk about hacking, mitigations, and LLMs... or if you prefer a longer title: "Pathfinding in the security landscape: What makes a good mitigation and where LLMs might take us" After that, Thai Duong Dionysus Blazakis Bruce Dang will moderate a panel discussion with questions. Send in your questions using this form: https://lnkd.in/gTiSc4aq. This event will be live-streamed on YouTube and open to everyone. Here is the stream info: 📅 August 12, 2026 8:00 AM – 9:00 AM PDT 🎥 Watch live: https://lnkd.in/gaVMszr6 🗓️ Add to your calendar: Google Calendar: https://lnkd.in/gGD3quXz Outlook Calendar: https://lnkd.in/gbA_mWic

Heading to DEFCON this year! I'm super excited to share this research on BGP! It'll be my first time to speak in person at a major conference. I've been to DEFCON a couple times for the conference and CTF, but never on stage. This sure will be an interesting experience. Shout out to Calif for supporting my research. I'll also like to thanks all the researchers from the prior research that goes into this. Thanks everyone for making the knowledge public that allow new interesting, fun discovery. https://lnkd.in/gtcbxBRd

We're excited to announce the new date for our livestream with Samuel Groß (https://x.com/5aelo)! Our researchers spent several weeks developing a full Chrome exploit chain and wondered about the current state of the art in this area. For the benefit of the community, we invited the GOAT of browser exploitation, Samuel Groß, to share his perspectives on modern browser security and exploitation. This event will be live-streamed on YouTube and is open to everyone. Livestream link: https://lnkd.in/g5gynSUa Submit your questions: https://lnkd.in/g9Z8sg76 Add to Google Calendar: https://lnkd.in/g2kYTUHv Add to Outlook Calendar: https://lnkd.in/gsg2vbqg

Since March, we've reported 36 vulnerabilities and counting to Apple. It's been a very productive and respectful collaboration. Several of these issues are expected to be fixed soon. Next month at Black Hat USA (https://lnkd.in/gsR8c-fA) we'll share the bugs we discovered in May and show how they can be chained together to bypass Apple MIE. We have many more exciting results to share once the remaining fixes have landed. It may sound counterintuitive, but we do this for fun, not for financial reasons. Sure, it's always nice to receive a bounty, but that's never been our motivation. We're fortunate to have a rapidly growing, profitable business, and we're lucky to count many of the world's leading companies among our clients. You can see the list on our website: https://calif.io. That's what funds our research. So what motivates us? Since we started this journey of hacking the Internet with AI, we've met many talented people and small teams who deeply care about making the Internet safer. We think they're super cool, and we hope to be like them when we grow up. Maybe that sounds a little childish. But deep down, every hacker is still a curious kid who just wants to understand how things work, and play fun games with friends. That's us.

The Internet means a lot to us, and today we're incredibly proud to partner with OpenAI and HackerOne to help make it safer. One detail we couldn't help but notice: in the announcement, OpenAI mentioned Calif four separate times and highlighted our work throughout. Does this mean our valuation has instantly quadrupled? Asking for a friend. https://lnkd.in/gdTSzqDc

Our researchers spent several weeks developing a full Chrome exploit chain and wondered about the current state-of-the-art in this area. For the benefit of the community, we invited the GOAT of browser exploitation, Samuel Groß (https://x.com/5aelo), to share his perspectives on modern browser security and exploitation. This event will be live-streamed on YouTube and open to everyone. Livestream link: https://lnkd.in/giaatFNr Submit your questions: https://lnkd.in/g9Z8sg76 Add to Google Calendar: https://lnkd.in/gDFyXNJt Add to Outlook Calendar: https://lnkd.in/g32ZfCcE