Richard’s blogs on Cloud Security

Technical deep dive in to CVE-2026-22730 SQL injection in Spring AI MariaDB store, its impact on RAG systems, exploitation & mitigation steps

Informe técnico de una vulnerabilidad ya corregida en Instagram Notes que exponía el audio original de vídeos mediante URLs directas. - i12gocaj/Instagram-Notes-Audio-Leakage-via-URL-Extraction-Fixed

Consistency and patience are not soft skills in bug bounty. They are the strategy.

Introduction
Hello, I’m RyotaK
(@ryotkak
), a security engineer at GMO Flatt Security Inc.
A while ago, I participated in the Google Cloud VRP bugSWAT,
a live hacking event organized by Google.
During this event, I discovered a remote command execution…

Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.

BeyondTrust Phantom Labs reveals a critical command injection vulnerability in OpenAI Codex. Learn how malicious GitHub branch names enable OAuth token exfiltration and create systemic AI coding agent security risks.

The Bug
This blog post outlines the chains of multiple gadgets to achieve a full read ssrf on a target.

Open Dynamic client registration on the MCP server to create an open redirect gadget

Path norm

Our audit of WhatsApp’s new “Private Inference” feature shows that trusted execution environments (TEEs) aren’t a silver bullet.

The Cyber Security & Resilience Bill is both predictable and significant, here are five key takeaways that matter most for organizations trying to understand what this Bill really means in practice. 

We released a new Testing Handbook chapter providing a comprehensive security checklist for C and C++ code review, covering Linux, Windows, and seccomp environments.

At ProjectDiscovery, we've been building Neo, an autonomous security testing platform that runs multi-agent, multi-step workflows, routinely executing 20-40+ LLM steps per task. Vulnerability assessments, code reviews, and security audits at scale, enabling…

Following our April 2024 announcement, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macO…

Google is continuously advancing the security of Pixel devices.

What you will learn How AI is changing bug bounty Where AI helps security teams Why human hackers matter What the future of bug bounty looks like AI and all the tools built around related technologies...

Introducing the official Burp Suite Ambassador Program

Trail of Bits discovered and exploited memory safety and logic vulnerabilities in Google’s Rust zero-knowledge proof code to forge a proof claiming better quantum circuit performance metrics than Google’s original results, demonstrating unique security risks…