{
  "id": 230096,
  "title": "schrodingers-toctou: The binary you run is not the program you wrote",
  "url": "https://urgent.news/2026/08/06/schrodingers-toctou-the-binary-you-run-is-not-the-program-you-wrote",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-06T15:47:45.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://github.com/xoreaxeaxeax/schrodingers-toctou"
  },
  "original_language": "en",
  "account": "Compilers can rewrite source code in ways that may introduce vulnerabilities, such as time-of-check to time-of-use (TOCTOU) bugs. These vulnerabilities occur when a program checks the validity of a value and then uses that value, but an attacker can change the value in between the check and the use. The issue arises because the compiler may insert an extra load of the value, even if it was not explicitly written in the source code. This can lead to the validation of a safe value while the actual value used in the program is different and potentially malicious. To mitigate this, developers should snapshot and validate any potentially tampered data before using it, ensuring that only the validated copy is used in subsequent operations. However, even this approach may not be foolproof, as compilers can still introduce invented loads that reintroduce the TOCTOU vulnerability. The only reliable way to determine if a particular piece of code is vulnerable is to build and test it, as the behavior can change based on the compiler version, target architecture, and compiler flags used during compilation.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}