We chain returned-pixel ASLR disclosures with a libheif heap overflow through WordPress and ImageMagick, then validate RCE across exact Ubuntu and Debian profiles.
Category: Research
CVE-2026-32740: RCE in a PIE Next.js sharp/libheif Stack
A fully remote CVE-2026-32740 RCE chain in a stock Next.js and sharp lab, using a pixel leak, chosen-address write and immediate memcpy GOT hijack.
Magento StyleSmuggler RCE: Report Poisoning to Code Execution
Complete HTTP-only reconstruction of StyleSmuggler (CVE-2026-75650), from report poisoning and a guest billing-address parser flaw through Email Preview, AWS S3Client, ArrayScanner and the final PHP include. Includes the working lab PoC, Adobe hotfix analysis and investigation guidance.
Reproducing CVE-2026-75604: Next.js Path Traversal to RCE on Windows
Vulnerability research · CVE-2026-75604 A single un-escaped backslash in the Next.js incremental cache lets an unauthenticated attacker read and write files on Windows hosts, and, on the right versions and app shape, run commands. Here is…
Keycloak CVE-2026-18963: Account Takeover via Reset-Credentials Bypass
Keycloak CVE-2026-18963: Account Takeover via Reset-Credentials Authentication Selector Bypass TL;DR An unauthenticated attacker can take over any Keycloak user account in Keycloak 26.7.1 by abusing the reset-credentials flow. The…
From Patch Diff to Pre-Auth RCE: Inside the WordPress 7.0.1 wp2shell Chain
We break down the WordPress 7.0.1 wp2shell chain: REST batch confusion, SQL injection, and how an unauthenticated attacker reaches RCE. Defensive analysis, no exploit code.
Philips Hue Bridge Firmware Emulation: Decrypting FW2 and Booting QEMU
A practical firmware-research walkthrough showing how we parsed Philips Hue Bridge FW2 updates, decrypted firmware sections, rebuilt the filesystem, and booted the bridge services in a repeatable MIPS QEMU lab.
LiteLLM Security: SSTI RCE and Unicode Sandbox Bypass
LiteLLM v1.82.2 security analysis: Two high-severity RCE vulnerabilities (Jinja2 SSTI and Unicode sandbox bypass). CVSS 7.2 HIGH, requires admin auth.
Critical Vulnerabilities in SGLang: RCE via Pickle Deserialization
Security analysis of critical SGLang vulnerabilities involving unsafe pickle deserialization and unauthenticated remote code execution risk.
Red Teaming LLM Web Apps with Promptfoo: Writing a Custom Provider for Real-World Pentesting
A practical guide to red teaming LLM web applications with Promptfoo, including custom providers, real-world API integration, RAG exploitation, and prompt injection testing.
Reforging Sliver: How Simple Code Edits Can Outmaneuver EDR
A red team research post showing how small Sliver C2 code changes can alter detection behaviour and help security teams understand EDR evasion trade-offs.
Vesta Admin Takeover: Exploiting Reduced Seed Entropy in bash $RANDOM
Research into a Vesta control panel admin takeover caused by reduced bash RANDOM entropy, including exploitation details and the security impact of weak randomness.
Feeld dating app – Your nudes and data were publicly available
Security research on the Feeld dating app showing how sensitive user data and private media became publicly accessible due to backend security weaknesses.
IDOR Exploitation via HPP – API hacking case study
An API hacking case study showing IDOR exploitation via HTTP parameter pollution, including why automated scans missed the issue and how manual testing found it.
Evaluating Banking Apps’ Security Against Mobile Theft: A Monzo Case Study
A mobile security case study assessing how banking apps protect users after phone theft, using Monzo as an example of real-world risk and defensive design.
Phishing Like a Pro: A Guide for Pentesters to Add SPF, DMARC, DKIM and MX records to Evilginx
A practical guide for penetration testers on configuring SPF, DMARC, DKIM, and MX records for Evilginx infrastructure to improve phishing simulation deliverability.
Password reset vulnerabilities in Grav CMS
Security research into password reset vulnerabilities in Grav CMS, showing how weaknesses in account recovery flows can lead to account compromise.
Reflected XSS in Kaspersky Security for Linux Mail Server
Security research on CVE-2024-1619, a reflected XSS vulnerability in Kaspersky Security for Linux Mail Server discovered during penetration testing.
Compromising Plesk via its REST API
Security research into compromising Plesk via its REST API, covering the attack path, exploitation approach, and lessons for securing hosting control panels.
A CSRF vulnerability in the popular csurf package
One of our customers asked us to review one of their pentest reports where one of the issues was that a CSRF cookie was missing the secure flag. Interesting to see that some people are trying to fix the LOW severity findings as well, we didn’t expect that.
