Aside from bragging how cool they are, what value is there for demonstrating a yet-to-be-patched vulnerability? I don't understand why old-guard infosec stars from Calif can do as they want, responsible disclosure be damned.

Just as a reminder for some folks here: During their WeWorm research in July–September 2026, Calif didn't stop at proving RCE to Tencent—they spent an extra week using AI to build a fully functional, self-propagating zero-click worm across three live phones, triggering temporary account bans from Tencent during testing.

▲

varenc 3 hours ago | parent | next [-]

I don't see this as irresponsible disclosure. They show that the vulns exist, but don't give any other details (unlike previous Calif releases). Not even a hint at what the exploit chain is like other than that it starts with a PDF, which is a surprise to no one.

They're of course also doing it for internet kudos, but attracting attention like this will help encourage people to update. Thanks to this article, I'm going to apply the next iOS security update ASAP, and tell everyone I know to do this the same. (hopefully it comes out soon)

I do wish they clearly stated the vulns have had been reported to Apple and when.

▲

cryptbe 2 hours ago | parent | prev | next [-]

We disclosed most of the bugs used in these chains to Apple, and are going to disclose the rest, if not already.

>Just as a reminder for some folks here: During their WeWorm research in July–September 2026, Calif didn't stop at proving RCE to Tencent—they spent an extra week using AI to build a fully functional, self-propagating zero-click worm across three live phones, triggering temporary account bans from Tencent during testing.

Not sure what exactly your point is. The WeWorm demo was done in a controlled environment.

Also we do this for free. We don't charge neither Tencent nor Apple. We don't even take their bounties. Why can't we have some fun?

If you're so upset about how we do it, my suggestion is go find your own bugs.

▲

creata 3 hours ago | parent | prev [-]

Is it irresponsible? They've revealed barely anything about how it works, besides that the first step is a PDF, and something about Glyph Grift.

	▲	eyalitki 3 hours ago \| parent [-]
		What is the value of revealing anything at this time point, when no patch is out? What use is it for the public? Just last Black hat there was a "glimpse disclosure" that was later followed with proper fixes and details. I gave my AI agent the details that were supposed to be "useless", before the patch was out, and it found the vulnerability in less than an hour. We shouldn't even enter this game. And with the track record of this specific group, I didn't exactly get the impression that their incentive is to help fix things, but rather to promote their brand while others be damned.