When we released WeWorm, we called for greater collaboration to address the risks of AI-powered cyberattacks. Today, The New York Times published a second article exploring why this matters: nytimes.com/2026/09/11/world… We also published our practical to-do list for collective defense: strengthen zero-click defenses, fund defensive security, proactively red-team critical infrastructure, and build open tools for real-time detection and containment. More: blog.calif.io/p/weworm-is-ca…

Today we published WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. We call you on WeChat and, without you answering or doing anything, take over your account within seconds. Then we use your phone to call your friends. Story and demos: calif.io/research/weworm

New research: OEMpocalypse Now! Our own Lukas Maar spent a few weeks pursuing one question: How do you turn a normal Android app into root access across as many phones as possible without rewriting the exploit for every model? Generic Linux kernel bugs offer broad coverage: one exploit can target both Pixel and Galaxy. But bugs that survive years of auditing often provide only constrained slab-level primitives, forcing the exploit into heap grooming and per-device tuning. Chipset drivers offer stronger primitives. A GPU or DSP driver pins and maps entire pages for the device, giving the attacker page-level access. But coverage follows the silicon, and each OEM ships several chipsets across its lineup. Lukas chose a third target: the code Samsung, Xiaomi, and Oppo build on top of Android. These components belong to One UI, HyperOS, and ColorOS rather than the underlying hardware, so they span an OEM's lineup regardless of chipset. The strategy exploits a page use-after-free in an OEM kernel driver. If SELinux restricts the driver to a privileged domain, an OEM sandbox escape reaches it first. A stale mapping to a freed physical page bypasses much of Android's kernel hardening. It requires no KASLR leak and hijacks no control flow, leaving slab protections and CFI irrelevant. The same page-reclamation code worked unchanged from kernels 5.15 through 6.12. Lukas built the chain three times, once for each OEM. The exploits run on a Galaxy S26 Ultra, Galaxy S26, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra, all running stock July 2026 firmware with locked bootloaders. The write-up includes demo videos. Part 1 explains the strategy, its reasoning, and its tradeoffs. Parts 2 through 4 present each OEM-specific chain. Read it at calif.io/research/oempocalyp….