A technical teardown of a multi-stage .NET dropper chain that hides its loaders inside bitmap pixel channels, wraps an Eazfuscator crypter around an academic epidemiology simulator, and delivers AsyncRAT 0.5.8. Includes pixelchain, a keyless end-to-end chain…

How three small bugs in WordPress Core chain into CVE-2026-63030 (wp2shell), a pre-auth RCE reachable with a single anonymous POST to the REST API batch endpoint.

Dozens of Chinese city, civic and state-media apps run their points-and-lottery campaigns on a handful of shared B2B SaaS backends. The signing that protects them uses a public salt and a key the server hands you on request. Here’s the multi-tenant exposure…

wp2shell chains a REST batch-route bypass and a SQL injection into pre-auth RCE on WordPress core. WordPress shipped forced auto-updates in 7.0.2, 6.9.5 and 6.8.6.

A critical pre-auth RCE hit WordPress core (wp2shell). A blog on how to check if you're exposed, hunt for compromise, and respond, plus two new free tools.

Our honeypots run no industrial equipment, yet 2,661 hosts sent a real Modbus, DNP3, S7comm or IEC-104 handshake in five months. Decoding the payloads: which scanners, which PLCs they hunt, and how far each probe goes.

TL;DR: it was possible to obtain NT AUTHORITY\SYSTEM privileges from the perspective of an unprivileged user using Foxit PDF Reader. The…

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures If you're running WordPress and want to check if your instance is vulnerable, you can use our tool we've hosted here: https://wp2shell.com/. We held off on publishing this…

Two components can each pass every scan and still combine into a vulnerability that lives in the seam between them.

ipapi.is offers precise IP data via a user-friendly API, encompassing geolocation, ASN data, hosting detection, VPN detection, and proxy detection.

SindriKit 1.5.0 introduces structural and instruction-level polymorphism via the SND_MORPH engine to eradicate static signatures on every build.

Evaluations and research on security, software, and AI by Vikrant Singh Chauhan.

Exploit development for the Windows WalletService vulnerability, from caller-controlled known-folder resolution to a persisted ESE callback and an interactive SYSTEM shell.

My thoughts on WHOIS and RDAP protocols.

The EV charging industry has well-established security standards. OCPP provides clear guidelines for securing the communication channel between EV Chargers and the Charging Station Management System. While the industry has focused on securing the backend…

Tachyon reviews pull requests in full-codebase context, validates exploitability, and gives developers fix-ready security findings before code merges.

The FCC has proposed Know-Your-Customer rules that would require telecom companies to collect a name, physical address, and government ID for every cellphone customer.

Island researchers uncover 7,600+ malicious GitHub repos, over 800 posing as AI Skills and MCP servers, that trick AI agents into recommending malware.

CybelAngel analysts found a decade of confidential financial sector data exposed on a personal NAS device, a huge third-party risk.

TLDR WPForms Lite is a WordPress form plugin with 5 million plus active installations. Public advisory data identifies versions 1.10.0.1 through 1.10.0.4 as affected by CVE-2026-4986: the PayPal Commerce webhook processed incoming events without first verifying…

On Tuesday, July 14, Microsoft released the largest Patch Tuesday update in its history, fixing more than 600 vulnerabilities. A bug I reported to Microsoft on May 17 was patched as CVE-2026-50458 in this release, so I am publishing the writeup I wrote at…