Team Triada
Research
CTF postmortems, offensive and defensive write-ups, and vulnerability research from the Team Triada security club.
LatestView all →
Scam 2026: Analyzing the Social Engineering Behind a Viral X Crowdfunding Scam
A cybersecurity analysis of the 2026 X crowdfunding scam, covering social engineering, OSINT verification, trust exploitation, and community-driven detection.
2026-10-08·9 min read
researchsocial-engineeringosint
wp2shell: Unpacking the WordPress Batch API Desync That Led to Pre-Auth RCE
A root-cause breakdown of CVE-2026-63030 and CVE-2026-60137, the array-desync bug in WordPress's REST batch endpoint that chains into SQLi and full unauthenticated site takeover.
2026-07-25·7 min read
wordpresssqlirce
Client-Side Secret Exposure in Modern SPA/JAMstack Applications
How we found hardcoded signing keys and BaaS credentials in production JS bundles across two separate engagements, and how we triaged them.
2026-07-02·5 min read
methodologysecretsspa