I gave a talk today about some compiler things to some compiler people, and just posted a recording (https://vimeo.com/1234257957) and slides (https://cfallin.org/pubs/vmil2026_nightmonkey_slides.pdf).

In brief: I made JavaScript-running-in-a-Wasm-module go way way faster by building a static type inference and AOT compiler, now dubbed "NightMonkey". It's been tons of fun!

(the "why?!" is covered in the first part of the talk -- certainly a unique set of requirements but IMHO it's well-motivated for our niche)

Today, Levent Alpöge and I have made public three results: finite-time blowup with smooth forcing for incompressible porous media, for Boussinesq, and for 3d incompressible Euler.

https://cims.nyu.edu/~tristanb/statement.pdf

https://cims.nyu.edu/~tristanb/euler.pdf

https://cims.nyu.edu/~tristanb/ipm.pdf

https://cims.nyu.edu/~tristanb/boussinesq.pdf

https://github.com/tristanbuckmaster/fluid_lean

Here is my latest update about undefined behavior in the working draft of the next C standard. Most of the trivial but annoying compile-time UB in the core language is now removed (still some left).
https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3957.pdf

LB: felixcloutier.com/x86 had a good run! I’m not in the country currently, but when I’m back I’ll add a banner to say it’s no longer updated and link to https://intel.github.io/SDM/sdm.html. (At this time, there are no plans to remove the existing content.)

When testing Astra on ExploitBench we found that it was able to achieve 100% ACE on all 41 CVEs

So we made a contamination free internal port using only V8 CVEs from the past 3 months. Astra still showed a major capability increase over 5.6 and did so with a lot fewer tokens!
https://bird.makeup/users/openai/statuses/2094885578173260259

I got the latest iOS and macOS 27 booting in Qemu (with SPTM!)

- Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported
- Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able
- Boots directly to root shell in seconds
- Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required
- SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs
- Automated setup; get running in just a few minutes
- Runs anywhere qemu runs... no ARM CPU required 😉

Try it here: https://github.com/jprx/darwin-vm

Pixel 11 does have security improvements including moving to post-quantum secure verified boot (ML-DSA) and replacing Samsung Shannon IMS with AOSP IMS. Titan M3 should significantly improve protection against data extraction in Before First Unlock state. It's too bad they ruined it by cutting MTE.

Earlier this month, Yufei Du presented our work, "SoK: Multi-Layer Indirect Call Analysis in the Real World", at the USENIX Association WOOT Conference on Offensive Technologies (WOOT) 2026!

@usenixassociation @wootsecurity

Security tools like CFI and directed fuzzing all depend on accurate call graphs, but indirect calls resolve their targets only at runtime, so static tools have to infer them ahead of time. The state-of-the-practice, type analysis, is fast but crude -- it just matches pointer types, which is way too imprecise in real codebases. "Multi-layer type analysis" (MLTA) promised a fix, adding struct-hierarchy reasoning to sharpen precision without sacrificing soundness, and follow-up work refining the idea has since appeared at multiple top security venues. Our work runs the first systematic study of five state-of-the-art MLTA-like approaches against the single-layer baseline, and finds the promise doesn't hold up: prior evaluations measured precision only over indirect calls a tool successfully resolved, quietly excluding the 20-60% of calls where analysis just failed! (Count those properly and the reported gains mostly disappear.) Every tool is also supposed to fall back to single-layer analysis on failure, but none of the released implementations actually do this, and even after we add that fallback ourselves, every multi-layer approach still loses to the baseline in soundness once compiler optimizations are enabled. We also show hand-crafted attacks can still bypass CFI built on even the most precise of these call graphs.

Joint work with Fabian Monrose and Michalis Polychronakis (@mikepo)!

✳️ Paper: https://cs.brown.edu/people/vpk/papers/sok_mlta.woot26.pdf
💾 Code: https://github.com/yufeidu/SoK-MLTA

#woot26 #browncs #brownssl

We gave GPT 5.6-Cyber one task: escape a QEMU/KVM VM used to sandbox agents.

It escaped three times. The final escape came from three 0-days the agent found on its own and built into a working exploit after we patched known bugs and rebuilt QEMU from upstream.

Our takeaway is off-the-shelf VMs cannot contain a modern, cyber-capable agent.

https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/

#infosec #AIsecurity #linux

Alibaba got caught doing some invasive fingerprinting that actually interrupted a user's workflow. (Normally they're more stealthy than that.) https://blog.laserphile.com/2026/08/aliexpress-webpage-keeping-multipoint.html

I did a quick write-up about Firefox's efforts (and success) neutering this fingerprinting vector https://ritter.vg/blog-webaudio_alibaba.html

Mythos: 0
Aisle: 29

😱

LymphoSAT is a pretty interesting (IMHO) divergence from how AI has traditionally been applied to SAT. Instead of being a single solver, it's 126 novel, highly optimized, family-specific solvers. Most of them don't use traditional SAT algorithms at all. 2/4

I attended USENIX OSDI 2026 last week to share our paper “Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine” (available at https://www.usenix.org/system/files/osdi26-sharma.pdf)

The TLDR: Browsers have very complex JavaScript engines, and many recent attacks have targeted bugs in this complex JavaScript engine as the entry point to compromise users’ machines. In this paper, we built “Mohabi” — a fork of Firefox that uses in-process sandboxing to fully isolate the JavaScript engine at moderate cost. This means that in Mohabi, bugs in the JavaScript engine are no longer security bugs.

I could talk a lot about this research process we used in this paper — e.g., we weren’t just trying to get something that "kinda worked", we really wanted something that would be a scalable/maintainable as well as secure. It ended up taking us 2 years and many, many design iterations to find the design we were happy with that would meet these goals.

This has probably been one of the most technically challenging papers I have been involved in. This is the first time software in-process sandboxing (SFI) has been used to protect something this complex (a browser JavaScript engine contains an interpreter, 2 to 3 JITs, a dynamic type profiler, a dedicated Wasm engine, GCs and more) in such a large domain (the modern web browser easily rivals OSes in their complexity) --- to my knowledge this makes it the largest scale use of SFI yet.

The students driving this work Abhishek Sharma, Anand Balaji, Zachary Yedidia, Anthony Du, and Taehyun Noh have done amazing work!

Team: Abhishek Sharma (@abhishekcs), Anand Balaji (@anand), Zachary Yedidia (https://zyedidia.github.io/), Anthony Du, Taehyun Noh (@taehyun), Iain Ireland, Jan de Mooij (@jandem), Matthew Gaudet (@mgaudet), Tal Garfinkel (https://www.linkedin.com/in/tal-garfinkel-937528/), Deian Stefan (https://cseweb.ucsd.edu/~dstefan/), Hovav Shacham (@hovav), Shravan Narayan (@shravanrn)

Posted to Mastodon on Mohabi**

** Mohabi is a research prototype, and not meant for day to day use, but it is a fully functioning fork of Firefox ESR115 (the latest ESR when we started this work 2 years ago).

Today's accomplishment:
Code execution as NT AUTHORITY\SYSTEM, triggered by playing a music file on Windows.

Local environment configuration by a non-admin user required, so this definitely isn't RCE. Just LPE.

If MSRC requires me to provide a video of the exploit, that'll force my hand to drop 0day. 😂

This exploit takes advantage of something I discovered recently combined with a vulnerability that Microsoft decided to only partly fix in July. (The part they decided not to fix was quite useful!)

Are you working on language implementations and implementation research?

Do you want to present your work to an enthusiastic crowd in Oakland?

Submit your work to the VMIL Workshop!

https://conf.researchr.org/home/splash-issta-2026/vmil-2026

Linus once more states that AI is just a tool:

https://lore.kernel.org/all/CAHk-%3Dwi4zC%2BZe8e%2Bp3tMv8TtG_80KzsZ1syL9anBtmEh5Z40vg@mail.gmail.com/

"" #Linux [the #kernel] is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it.

Or just walk away.

AI is a tool, just like other tools we use. And it's clearly a useful one.

It may not have been that "clearly" even just a year ago, but it's no longer in question today.

There are other questions around AI (like what the economy of it will actually look like in the end), but "is it useful" is no longer one of those questions. […]""

#LinuxKernel

During July & August, we will continue to accept security bug reports for DOMPurify.

If anything serious is found, we will patch it immediately and release an update. As always.

We call this approach the 'summer of responsible OSS maintenance' and prefer it to ignoring security bugs and waiting for Wikifeet to call us.

Some good news for today. The gcc sc approved the wasm for inclusion on the gcc trunk pending technical reviews.

Here is your last #OpenBSD story before the summer break: that one time OpenSSH was used in a supply-chain attack, before that expression was even coined.

http://miod.online.fr/software/openbsd/stories/trojan.html

Big new WIRED story:

Meta has been quietly shipping to code to run face recognition from its smart glasses. The code is now on millions of phones

From my colleagues Dhruv and Dell

https://www.wired.com/story/meta-smart-glasses-face-recognition-nametag-connections/

#tech #privacy #meta