A Certificate Name That Runs as Root: Five Bugs in Sophos Firewall, Found with CodexOct 6, 2026·10 min read
From Admin Panel to Root Shell: OS Command Injection in Dokploy's Backup Pipeline Using Codex SecuritySep 18, 2026·13 min read
From Graph Editor to Webshell: Finishing the Job CVE-2026-40079 Left OpenMost advisories end with "fixed." This one ended with a sentence that read like an open invitation: Status: PARTIALLY FIXED. The tune function is fixed. The graph rendering shell_exec path has residuOct 6, 2026·17 min read
mediaRoot Was Not A WallHow we use Codex to find vulnerabilities worked end to end on CVE-2026-59992 Broken access control in next-tinacms-s3 and its three sibling media adapters GHSA-8mq9-5fw2-5rm4 I. Introduction TinaCMS iSep 11, 2026·19 min read
Deleting any file on a Coolify managed server with a single `..`I. Introduction Coolify is an open-source, self-hostable PaaS that lets you deploy apps, databases, and pre-baked services on your own servers — the "Vercel/Heroku/Netlify replacement, but you own theJun 16, 2026·10 min read
Bypassing Kestra's path-traversal guard with a single backslashI. Introduction Kestra is an open-source event-driven workflow orchestration platform written in Java on top of Micronaut. It lets teams declare "flows" — task graphs that move data, call APIs, run scJun 16, 2026·14 min read
[CVE-2026-48731] AI-Assisted Discovery of Command Injection in Warp TerminalDisclosure status: Reported to vendor and coordinated through a private fix path. I. Introduction Warp is an agentic development environment, born out of the terminal. Use Warp's built-in coding agentJun 8, 2026·7 min read
AI-Powered Bug Hunting in Closed-Source Software:Author: Anhlt91, Thuanhn Date: May 2026Tags: AI Claude Bug Hunting Closed-Source Security Research Overview I used Claude AI to find real security vulnerabilities in a closed-source enterprise producJun 1, 2026·36 min read
Anatomy of a GHSA Collaboration: Fixing Filament's MFA Race TogetherI. Introduction Filament is an open-source full-stack UI framework for Laravel built on top of Livewire. It lets developers compose admin panels, forms, tables, infolists, actions, and notifications aMay 29, 2026·11 min read
![[CVE-2026-48731] AI-Assisted Discovery of Command Injection in Warp Terminal](https://cdn.hashnode.com/uploads/covers/699fec8cc9015c37f6e5364f/e7817cef-a8af-45ec-b931-4e08225edeb6.png)
