All Research
Every blog post, whitepaper, and research note, in one place.
Scam 2026: Analyzing the Social Engineering Behind a Viral X Crowdfunding Scam
A cybersecurity analysis of the 2026 X crowdfunding scam, covering social engineering, OSINT verification, trust exploitation, and community-driven detection.
wp2shell: Unpacking the WordPress Batch API Desync That Led to Pre-Auth RCE
A root-cause breakdown of CVE-2026-63030 and CVE-2026-60137, the array-desync bug in WordPress's REST batch endpoint that chains into SQLi and full unauthenticated site takeover.
Client-Side Secret Exposure in Modern SPA/JAMstack Applications
How we found hardcoded signing keys and BaaS credentials in production JS bundles across two separate engagements, and how we triaged them.
Old Commits, Live Credentials: The Git History Blind Spot
Why secret scanning limited to HEAD misses a whole class of long-lived exposure, and the sweep methodology we now run on every engagement.
SSRF via WordPress XML-RPC Pingback: A Recurring Finding
How we found and confirmed SSRF and brute-force amplification through a decade-old WordPress endpoint during a recent web assessment.