3 stories
The demos show a malicious PDF opened through iMessage or Signal ending in code execution, followed by an app that roots the phone. Calif says most of the bugs behind them already went to Apple.
The thread split over a different question: is it responsible to show a working takeover before a patch exists, or is the publicity what gets people to update?
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on 21 October, a day ahead of plan, after the CVE IDs leaked. Both bugs score CVSS 9.2 and need no login, and a proof-of-concept video went up by mistake.
In the thread, an admin racing across several servers said a three-line nginx rule blocking multipart uploads had been quietly protecting a machine he could not shut down.
Calif's researchers chained that use-after-free with a separate out-of-bounds write and got a root shell on OpenBSD with KARL, SMAP and SMEP enabled and no information leak. The counter, shm_nattch, was a signed short inherited from roughly 37 years ago.
