Nicky Mouha just posted a follow-up to his work on the SHA-3 reference implementation buffer overflow from last year: https://mouha.be/sha-3-buffer-overflow-part-2/