Quick POC using @nebusecurity CVE-2026-43499 to root my bootloader locked US S25 (SM-S931U1). Btw this works on latest fw. This phone is Android 16, June update. nebusec.ai/research/ionstack… I have detailed notes on flashing, exploitation, offset finding etc, blog post later 🖖

I was waiting for some research to complete and I decided to let astra have a look at some reinforcement learning work I did as a side project early 2025. Astra was very generous when it evaluated my novice attempts at training. I told it to do whatever it liked and retrain from scratch following the original constraints set out. After 30 minutes it came back and, well, you can see the results for yourself.

I am evaluating secure sandbox surfaces for high-trust agent environments (benchmarking, SFT, expert on-policy supervision, outcome based RL, etc). Obviously there are some pre-baked solutions, one that is attractive is Docker's sbx (docker.com/products/docker-s…). Sbx runs agents inside isolated Linux microVM's with their own kernel and private Docker Engine. They use filesystem passthroughs and host-side bridges to facilitate file access, networking, mcp tool usage, credentials, etc. These microVM's offer a very strong execution boundary but obviously the brokers are a major attack surface. Looking through the changelog for sbx, the situation is a bit more grim than you would expect. Between June 1 and today (Oct 24) there are 9 CVE's including critical issues (like a macOS virtio-fs escape CVE-2026-77179). These look like typical logic issues you might expect. What's interesting though is that the changelogs also reveal areas that got security fixes but no CVE. For example, a full broker mediated guest-to-host escape, shown in the poc below (on v0.39.0 before Sept 7). Some light reverse engineering was required since you don't get core implementation source. Pre-patch a sandbox could supply DBUS_SESSION_BUS_ADDRESS through the guest-controlled host_env sent to the host browser bridge. On the Linux host, the bridge passed that environment to xdg-open, whose desktop-detection path invoked dbus-send, which accepts a "unixexec:" address leading to code execution.

Starshield is used as part of operations that have significant national security implications (for example the NRO in the US). These services are also provided through strict contracts in Europe. When they are used arbitrarily for political coercion, violating those terms, they must be restricted and phased out. It's unbelievable that this is even in question. Either a contract has value or it has no value at all.