peterjson

Offensive Security Engineer at @calif_io

[peterjson @peterjson]

My and @testanull's analysis about ProxyShell Exploit

https://t.co/KFDtjIGuUs

[Calif @calif_io]

Early this week, we had a meeting at Apple Park in Cupertino. While there, we also shared with Apple our latest vulnerability research report: the first public macOS kernel memory corruption exploit on M5 silicon, surviving MIE. It was laser printed, in honor of our hacker friends.

Full story: https://t.co/AmKMGUmWPt

[Calif @calif_io]

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.

https://t.co/Cv8M69i1Mk

[thaidn @XorNinja]

We have some exciting news to share: @blacktop__ is joining Calif to work on a range of R&D projects focused on Apple and AI security.

If you work in the Apple security ecosystem, he’s already a household name. He’s the creator of:

* ipsw – the ubiquitous Apple firmware analysis tool: https://t.co/S763637ijE
* darwin-xnu-build – reproducible XNU kernel builds: https://t.co/Mel4PcLgQs
* ipsw-diffs – automated diffing of Apple releases: https://t.co/96A0D1Zu1Y
* The only public deep-dive on Apple’s Lockdown Mode: https://t.co/bCzLZrDlIM

His tooling is so good that even Apple engineers use it. If you do reverse engineering, chances are you’ve touched his Rust headless IDA MCP server: https://t.co/kkWMn4sGRX.

People have literally collected CVEs and bug bounties just by digging through the diffs produced by his tools.

With @brucedang, @Little_34306 and now @blacktop__, we're building a serious Apple security force at Calif. We’ll have more announcements in this space soon!

If you're interested in Apple security, AI, automated bug discovery, reverse engineering, or hacking, we’re hiring: https://t.co/6EjxrXKetQ.

[Calif @calif_io]

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets.

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.

https://t.co/IxURrHpBT0

[Yuval Avrahami @yuvalavra]

We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯

How did we do it? Just two missing characters was all it took.

This is the story of #CodeBreach 🧵👇

[Calif @calif_io]

“Vibe Hacking”: Abusing Developer Trust in Cursor and VS Code Remote Development

https://t.co/RtO9uNbVdN

[peterjson @peterjson]

@_l0gg @tuo4n8 Yeah, Apple should learn from the past, I used to report an unauth RCE for another Liferay instance. They should remove EOL products from their infrastructure 😅

[Rad @rad9800]

If you can motivate yourself to spend 8+ hours a day, 5 days a week to read through:
- Atlassian
- Jira
- Slack
- GitHub
- Other internal SaaS applications
without guaranteed results, you'll be an amazing red teamer.

[tuo4n8 @tuo4n8]

Submitted this bug to ZDI a long time ago, but they weren’t interested 🥲. Later sent to Oracle, marked dup of CVE-2023-22047. CVSS 7.5 but leads to unauth RCE. Fortunately, some big programs accepted it. Check exploit here :
https://t.co/1BilcgLUzR
#BugBounty #InfoSec #Oracle

[peterjson @peterjson]

@tuo4n8 it's time to collect some 💸, great work btw 👏

[Calif @calif_io]

Wormable Substack XSS: https://t.co/UkGDfGS1Ss

It must have been years since the last time a wormable XSS was found in a major social media website. This beautiful type confusion XSS attack vector is a gift that keeps on giving.

But most of all, @samykamkar is our hero!

[Calif @calif_io]

Type confusion attacks in ProseMirror editors

https://t.co/YUz3FWQm9H

[Calif @calif_io]

New blog post: in a recent engagement, we turned a simple XSRF in Argo CD to a shell with cluster admin privileges.

No fix is available. We recommend hosting Argo CD on an isolated domain.

Details: https://t.co/2oDy0asPyY

[Nguyen Hung @b4nhm1]

CVE-2023-49105 WebDAV Api Authentication Bypass using Pre-Signed URLs POC
Lazy coder + ChatGPT => nocode
cc @vigov5
https://t.co/Z2FUKZMH6v

[Calif @calif_io]

If you use https://t.co/rRSMl0rqfp in AWS EKS, be aware of a privesc vector that leads to full cluster compromise. We recommend revoking pod creation permission and switching to domain verification using DNS.

See the update at the end of this blog post: https://t.co/IouTvb4A1Z

[Calif @calif_io]

Pretty cool testimonial from @AnthropicAI. If you're into hacking AI models, we're hiring!

https://t.co/595YZ1SrgE

[peterjson @peterjson]

@testanull @Hu3skyS Better luck next time 🤣

[Calif @calif_io]

Calif US Offsite Summer 2023

[Calif @calif_io]

In a recent engagement, we encountered a target running CraftCMS, and discovered a Remote Code Execution vulnerability that allowed us to compromise the target.

https://t.co/U2OsIAyyba

CC @yeuchimse