To rebuild one submitted form, React scanned every field in the request once for each reference it contained. Nothing capped either number, so one 900 KB POST makes the server do 100 million checks and freeze.

A tool I built for driving an Android phone from a browser tab, with screen mirror, logcat, file browser, proxy, and Frida in the same window.

CVE-2026-47483 lets attackers crash NVIDIA DCGM Exporter via pprof. See what 2,000+ exposed GPU servers leaked and how to fix it.

We discovered an arbitrary file read vulnerability in Discourse's image pipeline by chaining a JPEG race condition with ImageMagick and Ghostscript.

Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into…

Empowering everyone to build reliable and efficient software.

I'm delighted to introduce Alex, my fellow swigger who I've collaborated with in the past with tools like DOM Invader. He showed me that it's possible to exfiltrate larger tokens than demonstrated in

An AI agent runs with your credentials and acts before you can stop it. Nine incidents show what that costs. Six controls limit the damage: sandbox the agent, scope its credentials, lock its configuration, log every call, scan the workspace first, and deny…

Analyzing Eufy Security Ecosystem and reverse engineering of its Homebase2 component

An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.

A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.

Summary This report covers a fullchain built from sync-demo LG-signed manifest replay client-key issuance bypass, cmp-client interactiveUrl PalmServiceBridge SSRF, and pmlogd collectAllLog targetDir command injection. First, the attacker replays the LG-signed…

php-fpm accepted FastCGI connections from any address sharing the first 96 bits of an allowed IPv6 address, because one memcmp asked for 12 bytes instead of 16.

Real intrusions run by autonomous AI agents, recovered from the agents' own attack transcripts. Operators set targets and rules; the agents ran the full loop from recon to root. Assessed as at least two threat actors, likely more.

Early in my career as a consultant, I was put on source code review engagements despite not being experienced. This forced me to deliver on projects that, looking back, were of a ludicrous size and scope for my skills at the time.

Those early career opportunities…

Cloud security challenges explained: the 6 most common security issues and risks of cloud computing, from misconfiguration to insider threats, and how to address each.

It is tempting to think of Windows in terms of a simple model: user mode and kernel mode. If a bug lets a user-mode process gain control of the kernel, it’s game over.

CVE-2026-81983: an Adobe Acrobat integer overflow vulnerability that corrupts memory when a malicious PDF is opened.

Intended audience: non-technical citizens of the web

How the Shai-Hulud worm reached npm through tensorlake@0.5.144, what it steals, how to check if you were affected, and how a 72-hour soak time blocks it.