Bug hunter, pentester, and OSINT investigator. I reproduce published vulnerabilities, run authorized engagements, and build the tools I would otherwise write by hand. I also audit open-source libraries and send the fixes upstream.
| Advisory | What it is | Score |
|---|---|---|
| CVE-2026-41089 | Netlogon CLDAP stack buffer overflow. One unauthenticated UDP packet to a domain controller. | CVSS 9.8, CWE-121 |
| CVE-2026-48866 | Gravity Forms path traversal into arbitrary file deletion. | CVSS 9.6, CWE-22 |
| SA-CORE-2026-014 | Drupal field_ui render-array callback. RCE once a contributed module is in play. |
Drupal 11.4.9, fixed in 11.4.10 |
The Drupal lab covers all three core advisories that 11.4.9 shipped with, including the two stored XSS issues. Every proof of concept runs against a local container, never a third-party host.
| Project | Contribution | Status |
|---|---|---|
| symfony/symfony | Strip the byte order mark at the start of a YAML stream | Merged |
| symfony/symfony | Skip empty lines when decoding CSV in the Serializer | Merged |
| symfony/symfony | Fix Glob patterns whose bracket expression contains a slash | Merged |
| projectdiscovery/dsl | Return errors instead of panicking on negative repeat counts and substr starts | Merged |
| projectdiscovery/nuclei | Bump govaluate and antchfx/xpath past two template panics | Merged |
| projectdiscovery/nuclei | Add a regression test for the govaluate string concatenation bug | Merged |
| symfony/ux | Let LiveComponent collections contain null items during (de)hydration | Merged |
| WordPress/sqlite-database-integration | Quote SQLite identifiers in LOCK TABLES, SHOW TABLES, and compound-PK indexes | Merged |
| WordPress/sqlite-database-integration | Split MySQL Proxy result packets at the maximum packet length | Open |
| WordPress/sqlite-database-integration | Pass workflow values via env in release workflows | Open |
| Repository | What it does |
|---|---|
| test-amnesty | Compares an edited pytest file against the original and catches tests that were weakened to pass. |
| cachelint | Predicts which Dockerfile layer busts the build cache and suggests a faster order. |
| codex-skills | Workflow prompts for Codex CLI. Each one pins exact commands so the model cannot skip a step. |
| cloud-file-manager | Self-hosted file manager with encryption at rest, per-file permissions, and access logs. |
| crystal-cavern | Puzzle game written in C++17 and compiled to WebAssembly, no runtime dependencies. Play it. |
- Building reproductions for Drupal 11.4.x advisories, one repository per release.
- Auditing fresh open-source releases. Five reports are sitting with vendors and maintainers right now.
- Turning the parts of pentesting I repeat by hand into small tools.
- X: @VortexXzy
- Bug reports and questions: open an issue on the relevant repository.
