CVE disclosures, AI red-teaming, and CTF writeups — published as they clear validation.
CVE-2026-9558 (CVSS 9.9): Server-side template injection in Mautic Twig themes enabling full RCE. Discovery, PoC, and coordinated disclosure.
Critical VM sandbox escape vulnerability (CVSS 9.9) in NocoBase enabling remote code execution. Full technical analysis, proof of concept, and disclosure timeline.
How utilitarianism, deontology, and virtue ethics guide responsible vulnerability disclosure decisions. A framework for balancing public safety and vendor relationships.
Chained XSS and prompt injection in Moodle GeniAI plugin v2.3.6 via PDF upload. Demonstrates AI-integrated plugin security risks.
Insecure direct object reference in Moodle's OpenAI Chat Block plugin exposing unauthorized access to chat data. Full exploitation walkthrough and CVE details.
Stored XSS in Moodle PDF Annotator plugin v1.5 release 9 through malicious annotation content. Technical analysis and responsible disclosure details.
Stored XSS vulnerability in Decap CMS versions up to 3.8.3 allowing script injection through content fields. Includes PoC and remediation steps.