Ryan Hanson

Security Researcher / Engineer. Hunting for weird bugs and building things.

[Ryan Hanson @ryHanson]

My Office RCE, CVE-2017-0199, won the Pwnie Award for Best Client-Side Bug! I'm speechless, thank you @PwnieAwards!

Photo Credit: @dalmoz_

[Ryan Hanson @ryHanson]

@francoatmega Only a few were found with agents

[Ryan Hanson @ryHanson]

My Apple exploit chain leveraged 7 different bugs and multiple techniques to achieve reliable code execution. I'm glad to see none of them were duplicates.

[Calif @calif_io]

Welcome to Hotel Calif. We're in lockdown mode. You can check in, but you can never leave. Broccoli is served around the clock.

The Brotli bug apparently affected iOS and macOS too. Apple released version 27.2.1 yesterday, fixing this bug among other security issues.

This is an important security update. If you haven't updated yet, now's a good time. The demos show what we were able to do with it.

[Calif @calif_io]

We've been having a ton of fun with GPT-6 Cyber, and now you can join the party too!

As @justdionysus put it, "It's the best model we've used so far for long running exploit development tasks. Its ability to construct libraries of primitives over time and then find a path through them to something stronger is a step change from previous generations."

First Mythos, now GPT-6 Cyber. We're proud to help push the frontier of AI security.

[Bruce Dang @brucedang]

this is madness. you have an iOS 27.2 chain and you only use it to fact check MacRumors?

can you use it to check the time as well?

[Calif @calif_io]

Lockdown Mode helps, until it doesn't.

[lambda @pwnlambda]

Finally back home! Slides from "0clicks in an AI World," the talk @brucedang and I gave at @unpromptedconf, are now up:
https://t.co/Jaqwn6Haal

[Blacktop @blacktop__]

Slides for my OffensiveCON - Japan '26 presentation 🇯🇵

https://t.co/JfW2zxwLGG

[Stefan Esser @i0n1c]

Just before Christmas I will be doing another MacOS Internals for Security Researchers training. It will have the lessons learned from our 27.x jailbreaks and a 27.0.1 to 27.2 kernel vulnerability diffing case study is added.

https://t.co/6bVxIxneQp

[Calif @calif_io]

Just in time for Halloween: Rust in Peace 🎃

We often share how we break software. Today, we show how we help defend it, replacing vulnerable C++ code with Rust, without a full rewrite.

https://t.co/Gs2ExequYl

[Ryan Hanson @ryHanson]

More true than ever. Logic bugs that expand attack surface that lead to exploitable 0days are my favorite.

[ϻг_ϻε @steventseeley]

In these trying times, I stand by my statement. Attack surface is the new 0day.

[Mas0n @Mas0nShi]

Apple has patched a vulnerability I reported that had been present for over a decade. The fix was released in macOS 27.2.

CVE-2026-112445

Of all the local privilege escalation (LPE) vulnerabilities I’ve seen, this is probably the easiest to exploit, the most straightforward, and the most bizarre—so bizarre that it makes you wonder whether it was an Apple backdoor.

https://t.co/j5jcC1D6xd

[msuiche @msuiche]

As soon as I heard @calif_io and @brucedang talking about FORCEDENTRY++ I had to add it to ELEGANTBOUNCER:

[Ryan Hanson @ryHanson]

@Bosco_The_Boss @calif_io Yes, the bugs are cross-platform. iOS, visionOS, and macOS

[Ryan Hanson @ryHanson]

This weekend I had Codex rewrite the iOS Gravity tweak to work with the code execution primitive of my chain so I could have a fun demo like @calif_io

Luckily it survived the 27.2 update. No this isn't a full jailbreak, just a powerful sandbox escape.

[Ryan Hanson @ryHanson]

@wouldntyaliket @calif_io Details will be released after it is patched

[Ryan Hanson @ryHanson]

@wngkng2091884 @calif_io No, it doesn't give root or command execution

[Ryan Hanson @ryHanson]

The best part of Apple bugs is they are often times cross-platform due to the amount of shared code. I bet their chain works on visionOS too.

[Calif @calif_io]

Apple Watch, Pyongyang special version, by @i0n1c

[Ryan Hanson @ryHanson]

@i0n1c I've experienced the slide hardcoding as well. Caught it when the target daemon slide changed after repeated crashes. Which lead to finding the leak to calculate the slide

[thaidn @XorNinja]

I just remembered why Brotli looked vaguely familiar: I worked on it at Google. I even co-authored an RFC [1]. Hopefully they haven't found my bugdoor 😅

Joking aside, CRIME [2] led me to work on things like Brotli and HPACK, the header compression scheme used in HTTP/2.

That was the magic of working at Google. They operated at such a huge scale that a few weeks of your work could become part of a widely used Internet standard. One of my fondest memories is helping audit QUIC and writing little bits of crypto code for it.

Before I left Google, a teammate on the Tink [3] team told me he believed Tink would last 50 years, outliving everyone on the team. Tink is now in its 10th year. 40 more to go!

I also learned that breaking things is fun, but lasting contribution often comes from building things that make the Internet faster and safer.

That same belief shapes much of our work at Calif. People know us for our offensive security research, but we've also done a lot of security engineering to harden systems and mitigate attacks, from large-scale Rust migrations to fast sandboxing or reducing zero-click attack surface in mobile apps.

We'll be sharing some of that work soon. Stay tuned!

[1] https://t.co/CmMc346RFF
[2] https://t.co/AS30xDRbDJ
[3] https://t.co/KiuQmVzZ5H