Writing
cve analysis
14 articles on this subject.
The document that reads your filesystem: XXE in docx, xlsx and SVG parsers
A docx, xlsx or SVG is a bundle of XML, and an XML parser that resolves external entities will fetch files and URLs on the attacker's behalf. CVE-2019-12415 in Apache POI is the office-document case. How XXE reaches an upload endpoint, how to find it, and how to turn it off.
9 min read
The cache said yes: web cache deception, cache poisoning, and CVE-2024-46982 in Next.js
Web cache deception stores a victim's private response for anyone to fetch; cache poisoning stores an attacker's response for everyone. Both come from the cache and the origin disagreeing about a URL. CVE-2024-46982 in Next.js is the current, well-documented case.
9 min read
One request, two lengths: HTTP request smuggling and the HAProxy Transfer-Encoding bug
CL.TE and TE.CL desync happen when two servers disagree about where a request ends. CVE-2019-18277 in HAProxy is the clean example: how the disagreement forms, how to find it safely, and how to shut it down.
8 min read
login failure for user -2 via ssh: triaging a compromised MikroTik RouterOS device
login failure for user -2 via ssh in a RouterOS log means the MikroTrick chain reached your router. What the -2 means, how to triage it, and what rebuild means.
13 min read
COPY ... TO PROGRAM in mail_logs: what Cisco's CVE-2026-76461 indicator actually means
COPY ... TO PROGRAM is a documented PostgreSQL feature that runs shell commands. Why Cisco's CVE-2026-76461 grep turns SQL injection into root, and how to hunt it.
12 min read
Indirect prompt injection: EchoLeak, CVE-2025-32711, and the email nobody opened
A crafted email sitting unread in an inbox was enough to make Microsoft 365 Copilot exfiltrate internal data. The injectable surface is every document the model reads, and the control that bounds it is least privilege on tools.
7 min read
Linux capabilities: root privileges without the SUID bit, and the container escape they enable
Capabilities split root into 40+ pieces, and about a dozen of them are still root. Which ones matter, how CVE-2022-0492 turned a cgroup detail into a container escape, and how to audit a host and an image.
7 min read
Sudo is a shell in disguise: CVE-2025-32463, GTFOBins, and reading sudo -l properly
A 9.3 in sudo itself, plus twenty ways a single sudoers line hands over root. How to read sudo -l like an attacker, why the chroot bug worked, and what a safe sudoers policy looks like.
7 min read
Encrypted is not authenticated: padding oracles, ViewState, and why leaked machine keys became a 2025 problem
CBC without a MAC lets an attacker decrypt and forge ciphertext using nothing but the server's error behaviour. The mechanism from first principles, the Telerik and ASP.NET cases, and the one rule that removes the class.
7 min read
JWT: alg confusion, kid injection, and the day Java accepted a signature of zero
A JSON Web Token is only as good as the verification code. Five failure modes with concrete examples, including CVE-2022-21449, where an all-zero ECDSA signature validated against any key on Java 15 through 18.
9 min read
GraphQL has no authorisation layer: aliases, batching, and the resolvers everyone forgets
GraphQL moves authorisation from the route to the resolver, and most teams only notice half of them. Introspection, alias multiplication, batched mutations against rate limits, and the complexity-DoS CVEs, with the fixes that actually hold.
8 min read
Argument injection: how a soft hyphen became CVE-2024-4577 and put 9.8 on the board
You escaped the shell metacharacters and the command still ran. Argument injection is the bug that survives shell-safe APIs, here is the mechanism, the PHP-CGI case that got mass-exploited, and the one-character fix.
7 min read
Pickle is a code format, not a data format: CVE-2025-32434 and the model file you just downloaded
torch.load(weights_only=True) was the recommended safe path, and it was bypassable. A practical look at Python deserialization, pickle, PyYAML and jsonpickle, how one gadget works, and what actually stops it.
12 min read
Server-side template injection: why {{7*7}} is a bad test, and how CVE-2023-22527 got to CVSS 10.0
Most SSTI write-ups teach one Jinja2 payload and stop. Here is the actual bug class, the per-engine probe table, a lab you can build in ten minutes, and the code-review rule that removes it entirely.
9 min read