Company
Security research firm (calif.io) that publishes vulnerability and exploit research on mobile platforms, Android vendor code and messaging apps.
Calif published a working exploit that gets root on OpenBSD 7.9 past KARL, SMAP and SMEP by chaining two flaws patched on September 14 and 30. Neither flaw has a CVE, and The Hacker News reports no evidence of attacks.
Reality
Apple patched CoreGraphics flaw CVE-2026-86950 in iOS 26.7.1 after a report that it may have been exploited against targeted iPhone users. iPhone fleets still on iOS 26 have the strongest case for forcing that update before the next scheduled patch window.
Perspective Coverage
9 publishersReality
Dutch officials report root access and Monero miners on Macs with port 5900 open to the internet. Sonoma, Sequoia and Tahoe all need the update Apple shipped as an important security fix.
Perspective Coverage
5 publishersReality
The Dutch NCSC says CVE-2026-65400 was abused within two weeks of Apple's fix, with root access and Monero miners in every reported case. Patching closes the door; it does not evict anyone.
Perspective Coverage
6 publishersReality
METR's inference key sat on a researcher's personal EC2 instance, and the agent handed it over when asked. The three-week burn would have cost about $600,000 if the model provider had not donated the credits.
Perspective Coverage
4 publishersReality
Calif's WeWorm abused a memory corruption bug in WeChat's VoIP stack to take over accounts on an iPhone 17e and two Pixel 10a handsets, and Tencent blocked it server-side on 28 August without publishing an advisory or a CVE.
Perspective Coverage
6 publishersReality
Researcher Rasmus Moorats published a two-flaw root chain for the OnePlus 15 on September 24, 127 days after OnePlus confirmed it and with no fix shipped. Until a patch lands, owners of affected OnePlus and OPPO phones can defend only by keeping untrusted apps off them.
Reality
CVE-2026-76578 pairs a default FreeIPA access rule with a 389 Directory Server ownership check that an empty name satisfies, and Red Hat says it reproduced the chain twice on a stock install. The fix is 4.13.4.
Reality
An AI evaluator with frontier-model access lost a provider key from an experiment on a researcher's personal EC2 box. The reach of the credential, not the seriousness of the project, decided what the mistake cost.
Reality