My blog, mostly about programming

Human

Learn how our AI found a one-click RCE vulnerability in 3 code editors: Cursor, VS Code, and Google Antigravity.

Pre-auth RCE in screensharingd — SRP frame-length validation returns success on oversized frames, bypassing authentication entirely. Root file read/write → code execution via /etc/sudoers.d + /etc/zshenv (SIP-compatible). No user interaction required.

You can outsource the hacking, but not the understanding

The rise and fall of the largest bug bounty platform in the world

Burp Suite is a MITM proxy running two separate TLS connections. The second one has its own fingerprint, and modern bot detection notices. Here's how to spot it and fix it.

Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities.

This work is my contribution to Sentry's AI Security research initiative, run through SARC, the Sentry Applied…

Getting back into bug bounties in 2026? What's changed, how the top hunters actually use AI, which vulns to chase, and where the good writeups live now.

Preface

This post releases a new universal chain that turns a single Marshal.load into command execution on Ruby, built with new gadgets from untapped sources as well as old gadgets put to new use.

Suddenly, you’re in a room. You look around - oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded.

You know the drill - it’s the typical enterprise “please don’t be a bad person or we may have

Back in April, I was talking with our system and software engineering teams at PRODAFT about the possibilities of using a managed database service. Due to the nature of our business, we simply cannot start using managed services right away. I told my team…

n8n used a user-supplied schema name as a key on a plain object. Setting it to __proto__ polluted the prototype and led to RCE through the Git node.

A critical unauthenticated Remote Code Execution (RCE) vulnerability in CircleCI’s Model Context Protocol (MCP) server allowed attackers to spoof client headers and execute arbitrary pipeline code without credentials.

Hello Everybody, Today in this writeup I am going to explain my findings of a Microsoft’s Important Severity bug which ultimately leads to…

SQL injection + root command injection + CVSS 10.0 nginx bypass + unauthenticated JWT minting = one request to root on any UniFi OS device. Full technical writeup.

After many years of complaining about how insecure SAML is, I decided to try to prove it by using Claude Code to hack every SAML implementation I could find.

Cycode research: NASA/JPL's AMMOS AIT-GUI ground console ships with no auth, no CSRF, and a 0.0.0.0 bind, enabling unauthenticated command execution. Fixed in 2.5.2.