Archive
A Certificate Name That Runs as Root: Five Bugs in Sophos Firewall, Found with Codex
From Admin Panel to Root Shell: OS Command Injection in Dokploy's Backup Pipeline Using Codex Security
One Byte Of Disagreement
One Route The Patch Forgot
mediaRoot Was Not A Wall
Deleting any file on a Coolify managed server with a single `..`
Bypassing Kestra's path-traversal guard with a single backslash
[CVE-2026-48731] AI-Assisted Discovery of Command Injection in Warp Terminal
AI-Powered Bug Hunting in Closed-Source Software:
Anatomy of a GHSA Collaboration: Fixing Filament's MFA Race Together
How I Use Claude Code to Fix Security Vulnerabilities
Abusing an Unauthenticated Local Server to Overwrite LLM Wiki
AI-Assisted on RASP Analysis
Reasoning-First vulnerability research: How I built an AI Agent that found multiples bugs in Open Source project
AI-Powered Vulnerability Hunting in WordPress Plugins/Themes
Firmware Emulation With an Automated Skill Set
From Privilege Escalation to RCE in Wiki.js
AI-Assisted Discovery of SQL Injection & Stored XSS in Cacti Network Monitor
Two Access-Control Failures in SiYuan: Unauthenticated SQL Read and a Read-Only Role That Can Rewrite Server Config
JSON-Path Traversal Injection in Kysely A Case Study Powered by ClaudeCode
Drag-and-Drop Path Injection Still Allows RCE via Shell Command Substitution
[CVE-2026-34612] AI-Assisted Discovery of SQL Injection Leading to RCE in Kestra v1.3.2
Giới thiệu về prompt engineering
Security Risks of "OpenClaw things"