All writing
Research findings and the trial and error behind them — shared openly, nothing held back.
- All tags
- ai-agents
- autonomous-research
- barebox
- bootloader
- buffer-overflow
- busybox
- case-study
- command-injection
- confused-deputy
- contiki-ng
- cve
- heap-overflow
- integer-overflow
- integer-underflow
- iot
- ipc
- libgit2
- lpe
- methodology
- not-vulns
- privilege-escalation
- provisioning
- reverse-engineering
- ssh
- strongswan
- u-boot
- vulnerability-research
- windows
- All years
- 2026
- Newest first
- Oldest first
- Reading time
CVE-2026-5917: OS Command Injection in libgit2’s SSH Backend
libgit2’s libssh2 backend quotes the repository path but escapes nothing. One quote in the path can run commands on an SSH server that gives a shell.
CVE-2026-5857: Remote Code Execution in Contiki-NG’s MQTT Client
A malicious broker splits one PUBLISH across two TCP segments, skips a bounds check that is present and correct, and overwrites a function pointer.
CVE-2026-18759: Privilege Escalation in ASUSTOR Backup Plan
ASUSTOR Backup Plan’s Windows service ABP_VSS_Service treats encryption as authentication and checks paths with a substring test. Standard user to SYSTEM.
U-Boot TCP/NFS Vulnerabilities: Integer Underflow and Buffer Overflow in the World’s Most Popular Bootloader
Three CVEs in U-Boot’s network stack: a TCP integer underflow that corrupts packet processing and an NFS path overflow that escapes a 2048-byte buffer.
Four Vulnerabilities in barebox: From DHCP Parsing to EFI PE Loading
Four CVEs in barebox: an unbounded DHCP option scan, two ext4 parsing flaws, and a PE virtual-size integer overflow in the EFI loader.
RogueProvision: A SYSTEM Task That Applies Unsigned Provisioning Packages — admin to SYSTEM, declined by MSRC
A SYSTEM service applies unsigned .ppkg packages from a folder — no signature, no consent. Microsoft’s docs promise otherwise. Honest catch: admin→SYSTEM.
Rebuilding a Security Researcher’s Mind in an AI — the Method, the Rig, and What It Cannot Do Yet
Building an AI that reverse-engineers undocumented Windows internals and raises its own hypotheses. The method, the rig, and the limit it has not crossed.
Same Workflow, New Target: AI-Assisted Discovery of CVE-2026-29004 in BusyBox
How the AI workflow that found a strongSwan zero-day discovered a 9-year-old heap overflow in BusyBox’s DHCPv6 client, plus a full PoC walkthrough.
Finding a 15-Year-Old Zero-Day in strongSwan with AI-Assisted Code Analysis
How I discovered CVE-2026-25075, a bug hiding in strongSwan since 2011, using a structured multi-pass AI analysis workflow.
No posts match the current filters.