pkgconf / build toolingSep 12, 2026
A pristine file, a directory name, and arbitrary code
Original research into a build tool’s shell output: why it looks inert in review, how far it actually reaches, and the one substitution that fixes it.
Research
Offensive security research from the team building Trident.
- Write-ups
- 4
- Benchmark
- 1
- Latest
- Oct 18, 2026
- Follow
- RSS feed
Benchmarks, Oct 18, 2026
Benchmarking Trident
How much does the harness change what a pentest agent finds? Every model we ran on both Trident and Claude Code confirmed a flaw in more runs on Trident.
Read the reportWrite-ups
defi / oracle boundsJul 11, 2026
Freezing a six-figure crypto vault
A few percent of disagreement between two contracts can freeze every deposit and withdrawal in a live crypto vault — and this one went unnoticed for six weeks.
cisco / unified cmJun 29, 2026
A phone system, one request, and root
An unauthenticated SSRF in Cisco Unified CM’s WebDialer chains to a JSP webshell and root-level compromise of enterprise voice infrastructure. Cisco patched it on June 3; within weeks attackers were dropping webshells over Tor, and CISA gave federal agencies until June 28 to fix it.
meta / instagramJun 1, 2026
Meta’s AI got tricked into resetting account passwords
Attackers simply asked Instagram’s AI support assistant to send password-reset codes to an email they controlled, and it complied.
