Evidence-backed security research, model evaluations, mitigations, and primary-source papers.

Adam Kues used a $200 GPT5.6 Sol Ultra subscription to discover a pre-authentication SQL injection and full RCE exploit chain in WordPress Core – a chain that chains a batch API desync, cache poisoning, changeset abuse, and hook injection into a complete…

A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.

Hey folks 😀 Hope you are doing great today! ❤

My blog, mostly about programming

Human

Learn how our AI found a one-click RCE vulnerability in 3 code editors: Cursor, VS Code, and Google Antigravity.

Pre-auth RCE in screensharingd — SRP frame-length validation returns success on oversized frames, bypassing authentication entirely. Root file read/write → code execution via /etc/sudoers.d + /etc/zshenv (SIP-compatible). No user interaction required.

You can outsource the hacking, but not the understanding

The rise and fall of the largest bug bounty platform in the world

Burp Suite is a MITM proxy running two separate TLS connections. The second one has its own fingerprint, and modern bot detection notices. Here's how to spot it and fix it.

Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities.

This work is my contribution to Sentry's AI Security research initiative, run through SARC, the Sentry Applied…

Getting back into bug bounties in 2026? What's changed, how the top hunters actually use AI, which vulns to chase, and where the good writeups live now.

Preface

This post releases a new universal chain that turns a single Marshal.load into command execution on Ruby, built with new gadgets from untapped sources as well as old gadgets put to new use.

Suddenly, you’re in a room. You look around - oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded.

You know the drill - it’s the typical enterprise “please don’t be a bad person or we may have

Back in April, I was talking with our system and software engineering teams at PRODAFT about the possibilities of using a managed database service. Due to the nature of our business, we simply cannot start using managed services right away. I told my team…