johnny

CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF — iOS/macOS kernel vulnerability leading to deferred panic (A19 Pro, iOS 26.3 RC)

UAF and AOP coprocessor panic in IOHIDEventServiceFastPathUserClient. No entitlements, reachable from app sandbox.

AppleKeyStoreUserClient close() UAF — PoC + diff analysis (bug found/patched by unknown third party in iOS 26.3 RC, not my discovery)

SEP firmware panic via AppleKeyStore - iOS/macOS 26.x kernel vulnerability

CVE-2026-20637: AppleSEPKeyStore Use-After-Free — iOS/macOS kernel vulnerability (patched in 26.4)

Analysis of CVE-2025-43529 (WebKit UAF) + CVE-2025-14174 (ANGLE OOB) exploit chain - iOS Safari

Codex-first fork of Anthropic's defending-code-reference-harness for vulnerability discovery and patch validation

Cyanide — iOS tweak runner built on top of the DarkSword kernel r/w exploit

WebKit NavigateEvent.canIntercept SOP bypass via cross-port interception — iOS 26.3.1 BSI (CVE-2026-20643)

IOSurfaceRootUserClient selector 0 kernel data abort via oversized XML IOSurfaceAddressRanges data — iOS 26.5 (23F77)

No description.

AGXCommandBuffer::generateMTLBarriers reachable kernel assertion via out-of-range barrier mask — iOS 26.5 (23F77)

iOS 18.4-18.6.2 userland exploit chain with JS injection into SpringBoard and other processes. Derived from DarkSword.

macOS HFS xattr overflow-extent aliasing PoC

macOS Skywalk/NECP stale-packet data.kalloc corruption PoC

The agent that grows with you

Packer plugin for Lume

A demonstration of arbitrary address referencing using cve-2025-43529