Pegasus

WebP BlastPass: One C Library Pwned Everything

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Identity & Phishing Security Web & API Security

CVE-2023-4863, a heap overflow in libwebp’s Huffman decoding, let the BLASTPASS chain install Pegasus via a zero-click iMessage image — and forced every browser, OS, and Electron app on earth to patch the same line of C.

Pegasus Zero-Click: Spyware That Needed No Click at All

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Emerging Tech & Architecture Identity & Phishing Security

The Pegasus Project exposed 50,000 targeted numbers and a hard truth: modern mercenary spyware infects phones through iMessage and WhatsApp without the victim doing anything.