Research
In-depth security research and analysis.
Broken Access Control in AI OpenRouter Gateway: CVE Research
A Filament gateway documents a config option to lock down its admin UI, but nothing in the code ever reads it. Any authenticated panel user reaches the full gateway: API tokens, system prompts, model settings and telemetry. Tracked as GHSA-57hh-5c98-83r8.
November 6, 2026 • 5 min read
Unauthenticated Settings Overwrite in WooCommerce Multistore: CVE Research
Exploit WooCommerce Multistore 5.4.7 unauth settings overwrite via curl POST to admin-ajax.php. Fake nonce, stock zeroing, SQLi via predictable key=1
September 10, 2026 • 4 min read
Infinite Loop svg2pdf.js CSS Selectors: CVE Research
svg2pdf.js 2.7.0 and earlier: an empty quoted string in a CSS selector triggers an unrecoverable infinite loop (CWE-835). Analysis, PoC and patch.
August 25, 2026 • 6 min read
Stored XSS Filament Comments: CVE Research (CVE-2026-90943)
Stored XSS filament comments: unescaped HTML rendering lets any user execute JavaScript in admin sessions. PoC and fix included.
August 21, 2026 • 6 min read
Picture in Picture Adware: The Chrome Tab Hijack
How a 200,000-user Chrome extension turned into Picture in Picture adware: a hidden tab on every update, traced end to end with IOCs.
July 15, 2026 • 6 min read
ModHeader Malware: Inside the Chrome Spyware Google Removed
This ModHeader malware analysis reverses the Chrome extension Google pulled and uncovers dormant, encrypted domain-harvesting spyware. Full teardown inside.
July 12, 2026 • 15 min read