Vulnerability research
Patch changes, failed security decisions, safe reproduction, and explicit evidence limits for named vulnerabilities.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 4
iOS Application Security in Practice: Auditing 30 OWASP MASVS Vulnerabilities with Frida and LLDB
Hands-on iOS penetration testing and secure coding: auditing Keychain misuse, bypassing client-side biometric checks with Frida, defeating SSL pinning, and mapping 30 real-world vulnerabilities to OWASP MASVS v2.
8 min read ↗Red Team · Nov 9, 2026Resilient Out-of-Band C2 Pipelines: Framing, AEAD Encryption, and Covert Channels in Go
Designing fault-tolerant, out-of-band command-and-control pipelines for authorized security testing: forward error correction via XOR parity, P-256 ECDHE session encryption, and 9 covert transport protocols in ghostlink.
8 min read ↗AI Security · Nov 9, 2026Breaking AI Agent Boundaries: From Prompt Injection to Remote Code Execution via Model Context Protocol (MCP)
How untrusted context in modern AI pipelines forces autonomous agents to execute arbitrary operating system commands through Model Context Protocol (MCP) server tools: indirect injection, ambient authority, and deterministic execution brokers.
14 min read ↗Exploit Development · Nov 6, 2026Stack Buffer Overflow: From Segfault to RIP Control (Ret2win)
The non-AD half of the journey: a 64-byte stack buffer, an unbounded read, and the exact steps that turn a segfault into control of the instruction pointer. Compiled live in a Linux container, with the one gotcha — the return address is not where the naive math says it is.
6 min read ↗CVE research 6
CVE-2026-125330: Cross-Workspace Session Access with a HarnessRouter Workspace Key
Root-cause analysis of CVE-2026-125330: HarnessRouter narrowed the session list to an API key's workspace, but the routes that take a session or response id checked only the organization. A workspace key that knew another workspace's session id could read, overwrite, publish and delete that session. Fixed in 0.31.7.
17 min read ↗CVE-2026-112950 · Lab ReproducedCVE-2026-112950: Windows Backslash Traversal in @vitest/mocker
Root-cause analysis of CVE-2026-112950: on Windows, a redirect mock path containing a backslash passes the Vite allowlist check added by the first fix and then reads a file outside the project root.
10 min read ↗CVE-2026-107716 · Lab ReproducedCVE-2026-107716: Symlink Traversal in banks Prompt Registry
Root-cause analysis of CVE-2026-107716: DirectoryPromptRegistry in banks followed symbolic links out of its prompt directory, so a link could make it read an arbitrary file through _scan() and get(), or overwrite one through set() and index.json.
10 min read ↗CVE-2026-102994 · Lab ReproducedCVE-2026-102994: Unbounded Token Scanning and CPU Exhaustion in pypdf
Root-cause analysis of CVE-2026-102994: before pypdf 6.18.0, a PDF with a very long object number and no whitespace made the parser read the token to its end with no limit, which can tie up a worker for a long time.
11 min read ↗CVE-2026-91117 · Lab ReproducedCVE-2026-91117: Uncaught ValueError on a NUL Byte in ServeStatic
Why a NUL byte that survives ServeStatic's path normalization makes its containment check raise an uncaught ValueError, so the request returns a 500 and, with Django DEBUG enabled, the technical error page.
9 min read ↗CVE-2026-87772 · Lab ReproducedCVE-2026-87772: Root Escalation Through the Pardus About Mount Helper
Root-cause analysis of CVE-2026-87772: Pardus About's passwordless Polkit action started a root helper that mounted attached disks with defaults,ro, so a setuid binary on a disk gave a local user root. Fixed in 1.2.5.
14 min read ↗