One of our security researchers demonstrated a local root shell on Linux using a page-cache poisoning primitive in AF_RXRPC’s RxGK path.
We call it DirtyCBC: a sibling to DirtyFrag in the broader CopyFail / DirtyFrag / Fragnesia family. The issue is fixed on mainline.
The candidate path was surfaced through Delphos’s agentic analysis workflow, then manually verified and exploited end to end.
AES-256 was not broken. It just wasn’t the boundary that mattered.
RxGK decrypted data in place before authentication completed.
Under the right conditions, that write could land in the page cache. The HMAC check still failed and the connection was aborted, but the page-cache mutation had already happened.
Two RESPONSE packets were enough to place a tiny ELF into the cached first page of a readable SUID-root binary. The file on disk stayed unchanged. The next exec produced a root shell.
Full writeup and PoC on the Delphos Labs GitHub.
https://t.co/gmCEub1v2t
We’re hiring 🚀
Security Researcher & Software Engineer @ Delphos Labs
Build AI-powered systems for reverse engineering — tools where AI understands software, automates binary analysis, and scales how we reason about code.
🔗 https://t.co/iDAbZZu5zz
#securityresearch#hiring
XZ backdoor (https://t.co/Te6s0hxcaZ.5.6.1) fully exposed in minutes with Delphos Labs.
Black-box binaries? No more.
Traditional tools would still be unpacking.
That’s software, verified.
Binary highlight: “Cyberpunk 7777 / QubePi” ELF. Text-menu game with hard-coded Postgres creds. Every login/chat/coord sent in clear on 5432—no TLS, no sanitization. Delphos auto-exposed the creds & flow in minutes.
Sample: https://t.co/pe4YmTEB5O
#ReverseEngineering
At @DelphosLabs, we're building tools to automate reverse engineering, no source code required.
Help shape what we build next 👇
https://t.co/cOAtvR5ad2
It takes just a few minutes. Anonymous unless you opt in.
Thanks for your input! 🙏
Machine Learning Meets Malware. If cognition becomes an API call and malware can be reverse-engineered by an LLM, then what’s left of “zero trust”?
Caleb Fenton joined @patio11 for a chat on AI, nation-states, and the new front in software security.
🎧https://t.co/FcExUUt6tz
If you like building platforms and infrastructure and want to get in on the ground floor of a cyber security startup doing AI and reverse engineering, DM me.
Happy Friday everyone! Want a ProcMon for macOS? Ever wish you had your own Endpoint Security client you could task? Want to peer behind the macOS EDR curtain? Have a go and let us know what you think!
https://t.co/uVL198bU0W
New Tiny #tinyML#AIoT module M0S coming out~
Based on BL616, WiFi6+BT5.2+Zigbee, 384MHz #RISCV RV32GCP, 4MB Flash + 512KB SRAM, and USB2.0 HS in tiny 10x11mm stamp module!
It would be <2$ ~
@caleb_fenton Depending on your point of view. Since it's all a simulation, everything is a dream. Saying that, in this iteration of the simulation I did use my Heelys in the office. Now we have carpets and I need to take them to Costco.
Yesterday @liba2k and I presented our talk "Breaking Secure Boot with SMM" at @1ns0mn1h4ck.
The slides, exploit code, and some additional resources are now online and available here: https://t.co/GAbeim2cWv
Thanks to everyone who attended, we hope to see you all again next time!