Pre-auth stored XSS in Formidable Forms
An unauthenticated file upload that exposed WordPress administrators to stored cross-site scripting.
Read articleOffensive security research.
Technical articles, vulnerability advisories, talks and publications.
Browse research
-
Whitepaper12 Aug 2026
Human-led offensive security in the age of AI
Governance, operational control and evidence quality when using AI in offensive security.
-
The Debrief11 Aug 2026
U-Boot parser, TP-Link MR600 V5, and router hygiene
Independent U-Boot reproduction, MR600 V5 fix analysis, and source-backed OT and IoT signals.
-
Article5 Aug 2026
Pre-auth stored XSS in Formidable Forms
An unauthenticated file upload that exposed WordPress administrators to stored cross-site scripting.
-
Advisory
CVE-2026-43797 · Apple Contacts
An app could access information about a user’s contacts. Apple addressed the issue with improved checks.
-
Advisory
CVE-2026-43759 · Apple CoreMedia
An authorization issue could allow an app to access sensitive user data. Apple addressed it with improved state management.
-
Advisory
CVE-2026-64716 · Apple ImageIO
Processing a maliciously crafted image could corrupt process memory. Apple addressed the issue with improved memory handling.
-
Article21 Jul 2026
An authenticated SSH denial of service in SFTPGo
An SSH handling issue found during a client engagement, fixed in SFTPGo 2.7.5.
-
The DebriefJuly 2026
WebKit memory disclosure, Splunk, and LiteLLM
Original WebKit research, control-plane analysis, and actions for Australian security leaders.
-
Advisory29 Jun 2026
CVE-2026-43740 · Apple WebKit
A WebKit memory-disclosure issue involving case-insensitive regular expressions.
-
The Debrief4 Jun 2026
Palo Alto, Exchange OWA, and the exposure numbers that matter
GlobalProtect authentication override, Exchange OWA mitigation limits, and a measured Australian exposure snapshot.
-
Article16 Mar 2026
Heap out-of-bounds in decompression loops
Integer overflow and bounds-checking failures in decompression code.
-
Advisory2026
CVE-2026-28922 · Apple CoreMedia
An Apple CoreMedia privacy issue that could allow an app to access private information.
-
Advisory2026
CVE-2026-28990 · Apple ImageIO
An Apple ImageIO memory-corruption issue triggered by a maliciously crafted image.
-
Advisory2026
CVE-2026-28859 · Apple WebKit
An Apple WebKit issue that could let malicious websites process restricted web content outside the sandbox.
-
Talk2025
From patch panic to proactive defence
Managing edge device vulnerabilities in 2025. Melbourne Cyber Conference, invited speaker.
// Next step
Send the context.
Link the article or issue you are referring to and tell us what you need. We reply within one Australian business day.