Blog
Read
Long-form write-ups, the vulnerabilities that cost the industry most, and a live wire of what's landing today.
Write-ups
Vulnerabilities that mattered
The bugs that reshaped the industry — what they were, why they worked, and what they cost.
- CVE-2024-309410.0critical
Backdoor in xz-utils liblzma
A multi-year social engineering campaign planted a backdoor in the xz release tarballs, hooking sshd via liblzma.
- CVE-2023-4966 Exploited9.4critical
CitrixBleed: session token leak in NetScaler ADC
An unauthenticated buffer over-read leaks session tokens from memory, allowing MFA to be bypassed by replaying a hijacked session.
- CVE-2022-22965 Exploited9.8critical
Spring4Shell: RCE in Spring Framework
Data binding in Spring MVC on JDK 9+ could be abused to reach class-loader properties and write a web shell, giving remote code execution.
- CVE-2021-26855 Exploited9.8critical
ProxyLogon: pre-auth SSRF in Exchange
An SSRF in Microsoft Exchange chained to arbitrary file write for unauthenticated RCE. Mass-exploited against on-prem Exchange worldwide.
- CVE-2019-0708 Exploited9.8critical
BlueKeep: pre-auth RCE in RDP
A use-after-free in Remote Desktop Services allowed unauthenticated, wormable remote code execution against a huge installed base of Windows hosts.
- CVE-2021-44228 Exploited10.0critical
Log4Shell: JNDI lookup injection in Log4j 2
User-controlled strings reaching a Log4j 2 logging call trigger a JNDI lookup, giving remote code execution.
- CVE-2017-0144 Exploited8.1high
EternalBlue: RCE in SMBv1
A flaw in Microsoft SMBv1 allowed remote code execution from a crafted packet. Weaponised by WannaCry and NotPetya into some of the costliest malware outbreaks on record.
- CVE-2014-6271 Exploited9.8critical
Shellshock: arbitrary code execution in Bash
Bash evaluated trailing code in specially crafted environment variables, giving RCE through anything that passed attacker input into the environment — CGI especially.
- CVE-2014-01607.5high
Heartbleed: memory disclosure in OpenSSL
A missing bounds check in the OpenSSL TLS heartbeat extension let anyone read up to 64KB of server memory per request — including private keys.