From Admin Panel to Root Shell: OS Command Injection in Dokploy's Backup Pipeline Using Codex SecurityI spent an afternoon pointing Codex, running on GPT-5.6-Sol, at a 37k-star self-hosted PaaS and walked away with an unauthenticated-looking path to root on the host. It wasn't actually unauthenticatedSep 18, 2026·13 min read
Bypassing Kestra's path-traversal guard with a single backslashI. Introduction Kestra is an open-source event-driven workflow orchestration platform written in Java on top of Micronaut. It lets teams declare "flows" — task graphs that move data, call APIs, run scJun 16, 2026·14 min read
[CVE-2026-48731] AI-Assisted Discovery of Command Injection in Warp TerminalDisclosure status: Reported to vendor and coordinated through a private fix path. I. Introduction Warp is an agentic development environment, born out of the terminal. Use Warp's built-in coding agentJun 8, 2026·7 min read
AI-Powered Bug Hunting in Closed-Source Software:Author: Anhlt91, Thuanhn Date: May 2026Tags: AI Claude Bug Hunting Closed-Source Security Research Overview I used Claude AI to find real security vulnerabilities in a closed-source enterprise producJun 1, 2026·36 min read
Anatomy of a GHSA Collaboration: Fixing Filament's MFA Race TogetherI. Introduction Filament is an open-source full-stack UI framework for Laravel built on top of Livewire. It lets developers compose admin panels, forms, tables, infolists, actions, and notifications aMay 29, 2026·11 min read
How I Use Claude Code to Fix Security VulnerabilitiesAbout this article This article documents how I use Claude Code in my CVE research workflow — specifically, how I handle the moment Claude gives me a fix recommendation for a vulnerability I've found May 29, 2026·11 min read
Abusing an Unauthenticated Local Server to Overwrite LLM WikiLocal HTTP servers in desktop apps are easy to overlook during a security review. They don't show up in bug bounty scopes, they're not publicly routable, and developers rarely treat them as a trust boMay 29, 2026·4 min read
![[CVE-2026-48731] AI-Assisted Discovery of Command Injection in Warp Terminal](https://cdn.hashnode.com/uploads/covers/699fec8cc9015c37f6e5364f/e7817cef-a8af-45ec-b931-4e08225edeb6.png)
