Research
Research
Methodologies, vulnerability analysis, and field notes from AI security and offensive testing — every finding traceable and verifiable.
2026-10-21
PHP2Shell: How Request Failures Become Remote Code Execution
7 minAn anonymized customer finding through SIRENBOW's security API provides the context for an analysis of CVE-2026-109618 and CVE-2026-109619: their origins, attack paths, and remediation.
2026-07-23
The missing check: a full-chain post-mortem of the $7.54M Verus bridge exploit
11 minThe Verus↔Ethereum bridge was drained for a second time. The attacker spent 0 ETH on the Ethereum side and forged a single cross-chain import. The root cause is one line that was never written: the bridge checked that the data was intact, but never that the withdrawal was backed by equal value.