Took some time to improve a few things on WinDiff (added permalinks, filtered out empty results) and added a Claude skill to easily use WinDiff to produce quick security-oriented diff analyses between binary/OS versions. Feel free to try! github.com/ergrelet/win...

Mozilla says Mythos helped identify 271 vulnerabilities in Firefox 150. I went through the commits, CVEs, and bug links to see what that number really means. My takeaway: relax folks. xark.es/b/mythos-fir...

Mozilla says Mythos helped identify 271 vulnerabilities in Firefox 150. I went through the commits, CVEs, and bug links to see what that number really means. My takeaway: relax folks. xark.es/b/mythos-fir...

Brief announcement: Launching Unprompted.au later this year in Sydney — a new conference focused on offensive and defensive security research using AI, and on how AI is reshaping the field. Sister conference to Unprompted. More updates coming soon

folks, what exciting project are you currently working on?

So I've been trying to dev an app using LLMs for a few weeks now, and I couldn't ever reach a satisfying state. Either talking to LLMs is an incredibly hard skill, or they are still very limited. I'm not even sure it would ace it if I asked it to write it in JS.

Happy belated new year! Linux 6.19 is now out in the wild and… ah, let’s just cut to the chase. We know what you’re here for! 😁 asahilinux.org/2026/02/prog... Thank you once again to everyone supporting us on OpenCollective and GitHub Sponsors!

Opus 4.5: "Given this limitation with split DWARF, let me take a different approach: parse the project source code to extract the class hierarchy. But that's complex..." (proceeded not to do the "complex" implementation) What are LLMs good for if they are lazy?! 🤣

How Michael Abrash doubled Quake framerate: fabiensanglard.net/quake_asm_op...

what do you all use for synchronized (multi device, cross platform) encrypted note taking?

Antide's Law — dustri.org/b/antides-la...

I reverse engineered DexProtector, the security solution protecting applications like Revolut and other banking apps. From custom ELF loaders to vtable hooking, here is an insight into how these protections work and their limitations. www.romainthomas.fr/post/26-01-d...

TIL about llvm-mca and its -timeline option, pretty cool for getting an understanding of instructions scheduling. Thanks Matt!

Day 9: Why does the compiler keep an "expensive" multiply in the loop instead of using clever addition tricks? The slower operation enables something more valuable. What's the hidden benefit? xania.org/202512/09-in... youtu.be/vZk7Br6Vh1U #AoCO2025

We launched a redesigned Project Zero website today at projectzero.google ! To mark the occasion, we released some older posts that never quite made it out of drafts. Enjoy!

In our final progress report for 2025, you'll find even more patches making their way upstream, 39C3, and a special treat for M2 Pro/Max MacBook users. Happy holidays from the Asahi Team! asahilinux.org/2025/12/prog... #asahilinux

I read the news about the React RCE but completely forgot I was hosting some React stuff! One of my server got pwned at least by 2 "attackers" only to download the same version of xmrig and run it... Disappointed.

I wanted to praise how @bsky.app was better than X after I couldn't reach it through IPv6, but actually I couldn't reach Bluesky neither. Sadge.

New Blog Post: Seth Jenkins broke kASLR by doing … nothing 😩 googleprojectzero.blogspot.com/2025/11/defe...

I have a spare hexacon ticket if anyone wants it

Hey friends, I am in Paris this week before attending @hexacon.bsky.social. Hit me up if you wanna catch up :)

In case you need it: building V8 on an aarch64 Linux xark.es/b/compiling-...

Gentle reminder: Rust &str are not null terminated.

Switching my blog to Next.js xark.es/b/switching-...

I added Bluesky posts as comments to my blog. Replying to this post should appear on my post page. Read more about it: xark.es/b/using-blue...