https://hanh.me/tags/security/Recent content in Security on Hanh Pham's BlogHugoen-usFri, 23 Oct 2026 09:53:53 +0700https://hanh.me/posts/ios-jailbreak-rootless-era/Sat, 17 Oct 2026 09:00:00 +0700https://hanh.me/posts/ios-jailbreak-rootless-era/The modern checkm8 continuation patches code signing, mount policy and task ports, and has no page-protection patch at all. What the gap in its own patch set says about the boundary everyone assumes is being crossed.https://hanh.me/posts/ios-jailbreak-userland-era/Fri, 16 Oct 2026 09:00:00 +0700https://hanh.me/posts/ios-jailbreak-userland-era/The bootrom era was unpatchable but fully readable. The userland era inverted both properties: every bug had a fix, and most of the tool’s shipped life has no published source at all.https://hanh.me/posts/ios-jailbreak-bootrom-era/Thu, 15 Oct 2026 09:00:00 +0700https://hanh.me/posts/ios-jailbreak-bootrom-era/The boot ROM is the one component no update can reach, so a bug in it is a bug in the hardware’s own trust anchor. What checkm8 established about unpatchable vulnerabilities, read from the public record rather than from a device.https://hanh.me/posts/ios-webkit-and-app-layer/Sat, 10 Oct 2026 09:30:00 +0700https://hanh.me/posts/ios-webkit-and-app-layer/WebKit and the app layer are the Apple surfaces you can actually study without a research device. How the browser’s processes are isolated from each other, what crosses between them, and where a third-party app’s own checks sit relative to the server’s.https://hanh.me/posts/ios-architecture-from-sandbox-to-secure-enclave/Wed, 07 Oct 2026 10:00:00 +0700https://hanh.me/posts/ios-architecture-from-sandbox-to-secure-enclave/A boundary-first map of the iOS stack, from app sandbox and XPC through XNU subsystems to PAC, SPTM, and the Secure Enclave, with the evidence gates I use before calling anything a finding.https://hanh.me/posts/uncensored-models-are-a-policy-surface/Tue, 06 Oct 2026 15:00:00 +0700https://hanh.me/posts/uncensored-models-are-a-policy-surface/Removing refusal behavior from an open model is technically easy. The hard part is proving what changed, containing the new failure modes, and keeping an agent with tools inside a safe boundary.