Research
- We can now find flaws faster than anyone can fix them
In 2024 our audit of PHP's core reported two flaws in the exact code behind php2shell and filed one as a crash. Two years later, three teams independently turned the same defect into a working attack in six weeks. The code never changed. The cost of looking at it did.
- One byte in nginx, and why 90 days is too long
F5 just patched CVE-2026-93479, a heap off-by-one in nginx's script engine we reported in July. The bug took four days to fix and 81 to disclose. That gap made sense when critical bugs were scarce. They are not anymore.
- Pre-auth RCE on MikroTik: exploited before the patch, rebuilt in three hours
MikroTrick, an unauthenticated MikroTik RouterOS takeover chain, was exploited in the wild before the advisory shipped. We rebuilt the full exploit from the public advisory and patch diff in approximately three hours.
- Anatomy of a Malicious Package: The Install-Time Playbook
A field guide to the techniques attackers hide inside npm, PyPI, and Crates packages, and the benign look-alikes that make them hard to catch.