deadb33f

Security Researcher iOS

[Pedro Ribeiro @pedrib1337]

The guy has a point - accelerated learning without understanding the basics is pointless. But at the same time, he doesn't give reasonable arguments to slow down. I think both can be done at the same time - learning the basics at human speed, while letting the machines work at machine speed.

[NOPcon @NOPcon]

A few moments from NOPcon 2026.

Huge thanks to all attendees, speakers, sponsors and everyone who showed up, shared knowledge and supported the community.

Until next time , happy hacking 🖤

[Alfie @alfiecg_dev]

@moo9000 DarkSword is 100% patched as of iOS 26.1, not sure where these rumours have come from.

[POC_Crew @POC_Crew]

What an amazing time with our friends. So happy to see @NOPcon back and to be part of its return as a sponsor.

See you all at #POC2026 in Seoul! 🇰🇷

[deadb33f @0xbadb33f]

It was a great event and I had an opportunity to meet a lot of fellow researchers. @NOPcon

[johnny @0xjohnny]

To celebrate iOS 27’s release, why not release a sandbox escape?

Announcing airlift: a PoC abusing a media sync path for out-of-scope access across much of /var/mobile via macOS↔iOS pairing.

No MobileGestalt edits yet; looking into it.

https://t.co/NXpVzwvgfH

[deadb33f @0xbadb33f]

I will be in Istanbul @NOPcon on 17th September. Looking forward to connect with some VRxD people. Dm me if you to want to say Hi :)

[MG193_7 @MGAldys4]

Guys, I built a super fast Android decompiler called ASC.

It completely replaced Jadx MCP for me and lets me analyze 10+ APKs in parallel.

And this week my Agent use ASC found 2 RCE in Honor and Xiaomi!
This tool now accepted by BlackHat EU Arsenal
https://t.co/5Qdpq8XEal
#BHEU

[Project Zero Bugs @ProjectZeroBugs]

Testing race conditions with memory access tracing and stack-based delay injection https://t.co/CQ1yh8lE5E

[Jacob Coxon @hilbertspaess]

I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.

[deadb33f @0xbadb33f]

@al_ramadan343 Hi I use multiple LLMs for each task. Nematron, Qwen and Kimi is good.

[deadb33f @0xbadb33f]

You don't need to open chats not even the messenger app. 0c achieved on iOS 26.6.1 after 72 hours of day and night effort. Of course without LLM it is not possible but you must guide it through every process where to look into, how to look and what to look.

[deadb33f @0xbadb33f]

@saaaadhjj Haha feels really good!! Hope you get this as well :)

[ONE Jailbreak @onejailbreak_]

📣CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71) by @ByteV0rtex

https://t.co/eCInGlTMRx

[John Ternus @johnternus]

hello

[deadb33f @0xbadb33f]

"Whatsapp is hard" says the VRxD community. Reaching native frameworks through rust meta checks is even harder. The strategy here is mix. It's about one missing logical check through static analysis and fuzz the file formats. I have found one. 1 click RCE!!!!

[GrapheneOS @GrapheneOS]

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

ARM hardware memory tagging (MTE) is used by GrapheneOS across the entire base OS including the kernel and every standard base OS process. It's only temporarily disabled for a few device-specific processes. It greatly improves protection against nearly all remote exploits and many local exploits.

Pixel 8 launched with hardware MTE support in October 2023. We integrated it into our hardened_malloc project and began using it across the OS later that month. Android and the Pixel OS never started using it by default. Android Advanced Protection Mode in Android 16 enables it for a few processes.

Apple's Memory Integrity Enforcement (MIE) is an always enabled feature on the iPhone 17. It's simply a high quality implementation of MTE using the latest standard extensions. It uses MTE in the most secure mode in the kernel and a large portion of userbase. They did a very good job integrating it.

Apple's MIE and Android 16+ AAPM don't use MTE for user installed apps unless those explicitly opt in. GrapheneOS enables it for more apps automatically and has a toggle for users to opt-in for every user installed app. There's a per-app toggle to opt-out for incompatible apps which is uncommon.

Neither iOS or Android encourage app developers to opt into MTE and other more aggressive security features used in the base OS. Apple's docs warn developers of performance and stability issues. Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.

Pixel 11 does have security improvements including moving to post-quantum secure verified boot (ML-DSA) and replacing Samsung Shannon IMS with AOSP IMS. Titan M3 should significantly improve protection against data extraction in Before First Unlock state. It's too bad they ruined it by cutting MTE.

Pixel 11 series is a lot more expensive for an incremental improvement to the CPU, the same underpowered GPU and reduced RAM for the Pro base models. They finally caught up to the last generation of Qualcomm cellular radio. It's overpriced, the upgrades aren't impressive and losing MTE is appalling.

Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has ~40% higher single threaded CPU performance, ~80% higher multi threaded performance, over 100% higher GPU performance and a far better cellular radio. It also finally has MTE. The next gen is what will be in the first Motorola with GrapheneOS.

Pixel 9a and earlier (including Nexus devices) were the Android Open Source Project reference devices. Pixel support was removed from AOSP with Android 16. It's now harder to support Pixels than many other devices and massive progress towards open source firmware and driver libraries was discarded.

Compared to the stock Pixel OS, GrapheneOS ships AOSP patches months earlier and Linux kernel patches many months earlier. However, we rely on them for firmware and most driver updates. We also want to move to new kernel branches earlier. These things can be improved with our Motorola partnership.

We strongly recommend against buying Pixel 11 devices. Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE. Pixel 11's Titan M3 should improve BFU security for users without a strong passphrase, but losing MTE craters AFU security.

We haven't determined what to do about this situation. It may be best for us to skip the Pixel 11 series devices. We can shift our focus entirely to the upcoming Motorola devices instead. Pixel 10a was really a 9th gen Pixel, so hopefully the Pixel 11a does the same with 10th gen and includes MTE.

[Joseph Ravichandran @0xjprx]

I got the latest iOS and macOS 27 booting in Qemu (with SPTM!)

- Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported
- Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able
- Boots directly to root shell in seconds
- Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required
- SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs
- Automated setup; get running in just a few minutes
- Runs anywhere qemu runs... no ARM CPU required 😉

Try it here: https://t.co/PEydRXL25G

[Rebane @rebane2001]

huh

[Vladislav Shevchenko @destr4ctt]

Sharing details & PoC for CVE-2026-43748, a heap OOB-write in ANEHWDevice::ANE_ProgramCheckandPrewireBuffers_gated (Apple Neural Engine)

Vulnerability was fixed in iOS 26.6 update. And for some reason, Apple missed me in advisory...

Frustrating :(

https://t.co/HAmApCS4EA