Pre-auth stored XSS in Formidable Forms
An unauthenticated file upload that exposed WordPress administrators to stored cross-site scripting.
Read articleOffensive security research.
Original application and platform security research, embedded-device analysis, vendor advisories and practical assessment guides. External advisories link directly to the publishing vendor or vulnerability record.
Explore by topic
Application and API security
API test scoping · Formidable Forms research · Application testing
Embedded devices and firmware
IoT assessment preparation · Firmware and router analysis · Embedded-device testing
Infrastructure and assurance
SFTPGo research · Human-led AI assurance · Infrastructure testing
Browse research
-
Planning guide
How to scope an API penetration test
A practical checklist for workflows, roles, tenants, documentation, test data and safe testing boundaries.
-
Planning guide
How to prepare for an IoT security assessment
Hardware samples, firmware, cloud access, recovery and engineering outputs for a connected-product assessment.
-
Advisory
CVE-2026-102300 · Google Chrome WebGPU
A high-severity uninitialised-resource issue in Chrome’s WebGPU implementation, fixed in a Chrome stable-channel update.
-
Advisory
CVE-2026-28934 · Apple HFS
A buffer overflow in macOS HFS handling could cause a system crash when mounting a malicious disk image. Apple added improved bounds checking.
-
Advisory
CVE-2026-65404 · Apple Accounts
An authorisation issue in macOS and iOS could let a malicious app bypass privacy preferences. Apple addressed it with improved state management.
-
Advisory
CVE-2026-87610 · Google Chrome Omnibox
A medium-severity authorisation issue in Chrome’s Omnibox, fixed in a Chrome stable-channel update.
-
Whitepaper12 Aug 2026
Human-led offensive security in the age of AI
Governance, operational control and evidence quality when using AI in offensive security.
-
The Debrief11 Aug 2026
U-Boot parser, TP-Link MR600 V5, and router hygiene
Independent U-Boot reproduction, MR600 V5 fix analysis, and source-backed OT and IoT signals.
-
Article5 Aug 2026
Pre-auth stored XSS in Formidable Forms
An unauthenticated file upload that exposed WordPress administrators to stored cross-site scripting.
-
Advisory
CVE-2026-43797 · Apple Contacts
An app could access information about a user’s contacts. Apple addressed the issue with improved checks.
-
Advisory
CVE-2026-43759 · Apple CoreMedia
An authorization issue could allow an app to access sensitive user data. Apple addressed it with improved state management.
-
Advisory
CVE-2026-64716 · Apple ImageIO
Processing a maliciously crafted image could corrupt process memory. Apple addressed the issue with improved memory handling.
-
Article21 Jul 2026
An authenticated SSH denial of service in SFTPGo
An SSH handling issue found during a client engagement, fixed in SFTPGo 2.7.5.
-
The DebriefJuly 2026
WebKit memory disclosure, Splunk, and LiteLLM
Original WebKit research, control-plane analysis, and actions for Australian security leaders.
-
Advisory29 Jun 2026
CVE-2026-43740 · Apple WebKit
A WebKit memory-disclosure issue involving case-insensitive regular expressions.
-
The Debrief4 Jun 2026
Palo Alto, Exchange OWA, and the exposure numbers that matter
GlobalProtect authentication override, Exchange OWA mitigation limits, and a measured Australian exposure snapshot.
-
Article16 Mar 2026
Heap out-of-bounds in decompression loops
Integer overflow and bounds-checking failures in decompression code.
-
Advisory2026
CVE-2026-28922 · Apple CoreMedia
An Apple CoreMedia privacy issue that could allow an app to access private information.
-
Advisory2026
CVE-2026-28990 · Apple ImageIO
An Apple ImageIO memory-corruption issue triggered by a maliciously crafted image.
-
Advisory2026
CVE-2026-28859 · Apple WebKit
An Apple WebKit issue that could let malicious websites process restricted web content outside the sandbox.
-
Talk2025
From patch panic to proactive defence
Managing edge device vulnerabilities in 2025. Melbourne Cyber Conference, invited speaker.
// Next step
Send the context.
Link the article or issue you are referring to and tell us what you need. We typically reply within one Australian business day.