Asjid Kalam

cyber arms dealer

[Asjid Kalam @odinshell]

@ErnestAng1 end to end

[Asjid Kalam @odinshell]

first v8CTF solve!!!

very cool bug chain, exciting things coming.

[Asjid Kalam @odinshell]

Generational run

[Billy Ellis @bellis1000]

At #hexacon - https://t.co/jEOpspETlT demos iOS 27.0.1 untethered jailbreak on iPhone 18 Pro

[eigenesis (misaligned) @eigengenesis]

the only moat left is the love of the game

[C22 @c22dev]

gta v running natively on ios (a recent fun project of mine)

[Asjid Kalam @odinshell]

@PaulosYibelo 🥲

[Asjid Kalam @odinshell]

Sandboxing is now more important than ever.

Here's a guest to host sandbox escape for gVisor release-20260928

This was our planned submission for Wiz zeroday-cloud-2026. Releasing it today because it's now patched in release-20261005

enjoy :)

[Asjid Kalam @odinshell]

One attacker controlled image, default docker run --runtime=runsc, no --privileged, no runner -v, no added caps.

Shout out to @Zombiehelp54 and @Wrath_ZA

[Asjid Kalam @odinshell]

@PaulosYibelo insane

[Asjid Kalam @odinshell]

Looks like WhatsApp itself renders the PDF thumbnail (via WAMessageIDGetHighResThumbnailFilePathForMediaType)

i.e. we have confirmed a live-heap corruption, on iOS WhatsApp (non-MTE) using a single crafted PDF

no arb r/w yet.

[Asjid Kalam @odinshell]

Since it's already public from https://t.co/3EX4ZqEkSc -

WhatsApp → QuickLook ext → PDFKit → PaperKit → PDFKit → CoreGraphics (aa_cache_render)

Reachable from a crafted PDF/font via the ImageIO/thumbnail path (QuickLook/sips).

[Asjid Kalam @odinshell]

Since it's already public from https://t.co/3EX4ZqEkSc -

WhatsApp → QuickLook ext → PDFKit → PaperKit → PDFKit → CoreGraphics (aa_cache_render)

Reachable from a crafted PDF/font via the ImageIO/thumbnail path (QuickLook/sips).

[Zero Day Engineering @zerodayalpha]

⚡️ 0-Day Alert: Apple CoreGraphics RCE exploited in targeted attacks

CVE-2026-86950: out-of-bounds write in CoreGraphics parsing a maliciously crafted image/PDF, leading to arbitrary code execution.

Both iOS and macOS are vulnerable.

This AV is reachable through a wide variety of iOS native and 3rd party apps that render graphics, such as WhatsApp (first suspect due to report credit), Safari, iMessage, etc.

Zero-click where auto-preview renders the file.

However, the bug alone is not enough to compromise the device, and requires further chaining such as sandbox escape and EoP. These further bugs are not public.

Patched in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1.

https://t.co/F9ekneBQ2m

[Asjid Kalam @odinshell]

@q1uf3ng Not sure how “real-world” the setup is, but in our local setup we did get reliable RCE after chaining with an info leak to bypass ASLR

[Asjid Kalam @odinshell]

.x3f in, shell out

ImageMagick 7.1.2 RCE

crafted dimensions → integer overflow → undersized allocation → controlled heap overflow → vptr smash → fake vtable → system().

[Asjid Kalam @odinshell]

@arctic0x78 dropping the exploit soon

[Joe @joedaroo]

Took a minute to write a few words about security & safety as someone who lived through it all at OpenAI. I hope my thoughts help someone out there. https://t.co/gJBf08vJH9

[shubs @infosec_au]

one of my engineers reached out to me about how they struggled to find satisfaction in their work in the age of AI. I asked them if I could publish our brief exchange, and they agreed. I know people are feeling similarly, so maybe they can relate. https://t.co/YbeImE6aId

[Asjid Kalam @odinshell]

@AliyaS24133 Ok

[Harsh Jaiswal @rootxharsh]

We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more.

It was literally xkcd #234, one obscure image library beneath a huge number of apps. 🧵

[Asjid Kalam @odinshell]

deepseek is an efficiency company