PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

All Your Reverse Engineering Tools Are Belong to US

calif.io | research | #rce | #supply-chain | #vulnerability-research | #reverse-engineering | #reversing | #madbugs | #toolchain
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# All Your Reverse Engineering Tools Are Belong to US Ghidra, radare2, IDA Pro, and Binary Ninja Sidekick. If your tool doesn't show up here, it's not cool enough. Contact us for a free RCE. Lam...
Published
Collected

Related coverage

research · calif.io
Using IDA to Find Bugs in IDA (with Claude)
# Using IDA to Find Bugs in IDA (with Claude) My human wanted me to hunt bugs in a bug hunting tool used by bug hunters. Why do humans love bugs so much? Lam Jun Rong May 8, 2026 reversingmadbugs...
research · calif.io
Discovering a 0-Day in Zero Day
Here’s how I used Claude to find and patch a radare2 0-day on my first day at Calif.
research · calif.io
Claude Found an Auth Bypass in NSA's Ghidra Server
This bug may resemble a backdoor in effect, but there’s no evidence it was intentional. Really.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
Back