Benasin

php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell

Demos we presented at Hexacon in Paris today. Everything will be released in due time. 1/ Signal 1-click

Today we published WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. We call you on WeChat and, without you answering or doing anything, take over your account within seconds. Then we use your phone to call your friends. Story and demos: calif.io/research/weworm

New research: OEMpocalypse Now! Our own Lukas Maar spent a few weeks pursuing one question: How do you turn a normal Android app into root access across as many phones as possible without rewriting the exploit for every model? Generic Linux kernel bugs offer broad coverage: one exploit can target both Pixel and Galaxy. But bugs that survive years of auditing often provide only constrained slab-level primitives, forcing the exploit into heap grooming and per-device tuning. Chipset drivers offer stronger primitives. A GPU or DSP driver pins and maps entire pages for the device, giving the attacker page-level access. But coverage follows the silicon, and each OEM ships several chipsets across its lineup. Lukas chose a third target: the code Samsung, Xiaomi, and Oppo build on top of Android. These components belong to One UI, HyperOS, and ColorOS rather than the underlying hardware, so they span an OEM's lineup regardless of chipset. The strategy exploits a page use-after-free in an OEM kernel driver. If SELinux restricts the driver to a privileged domain, an OEM sandbox escape reaches it first. A stale mapping to a freed physical page bypasses much of Android's kernel hardening. It requires no KASLR leak and hijacks no control flow, leaving slab protections and CFI irrelevant. The same page-reclamation code worked unchanged from kernels 5.15 through 6.12. Lukas built the chain three times, once for each OEM. The exploits run on a Galaxy S26 Ultra, Galaxy S26, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra, all running stock July 2026 firmware with locked bootloaders. The write-up includes demo videos. Part 1 explains the strategy, its reasoning, and its tradeoffs. Parts 2 through 4 present each OEM-specific chain. Read it at calif.io/research/oempocalyp….

Journey to Root, Episode I: The Maglev King Welcome to the first installment of our series on AI-assisted browser bug hunting and exploit development. We will walk you through a Google Chrome exploit chain, from the V8 JavaScript engine in the renderer to the GPU process. We demonstrate the full chain on Windows, and for the GPU compromise we also show a novel technique on Linux, where the mitigations are tougher to defeat. Demo (with BEATS!): youtube.com/watch?v=3l18B-b7… Full write-up: open.substack.com/pub/calif/…

Early this week, we had a meeting at Apple Park in Cupertino. While there, we also shared with Apple our latest vulnerability research report: the first public macOS kernel memory corruption exploit on M5 silicon, surviving MIE. It was laser printed, in honor of our hacker friends. Full story: open.substack.com/pub/calif/…

MAD Bugs: RCE in Ladybird Blog: open.substack.com/pub/calif/… PoC: github.com/califio/publicati… youtube.com/watch?v=NQxvMRqS…

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747) To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI. blog.calif.io/p/mad-bugs-cla…

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets. A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic. open.substack.com/pub/calif/…