DirtySlide - root on macOS from one missing bounds check
Unprivileged to root on macOS 26.5, no entitlements, Developer Mode off, through one unbounded loop in the dyld shared-cache slide walker. Fixed in macOS 26.5.2.
gracecondition
Recent content on gracecondition
Latest posts
wtf - pwnable.kr
Writeup of the pwnable wtf CTF Challenge
ParagOWNED - how CVE-2025-43200 likely abused Apple Intelligence to take control of an iPhone
How the paragon iMessage exploit worked.
machsec - detecting XNU binary mitigations
This article explains my new mitigation detection tool machsec, for iOS/macOS, alongside binary mitigations available on XNU
Passcode - pwnable.kr
Writeup of the pwnable passcode CTF Challenge