rootzero : Security articles and guidesTechnical articles, research notes and CVE write-ups from the rootzero team: offensive security, detection, method.https://rootzero.eu/en-GBCoreGraphics: what a targeted iOS file exploit actually revealshttps://rootzero.eu/en/research/apple-coregraphics-targeted-file-rce-2026/https://rootzero.eu/en/research/apple-coregraphics-targeted-file-rce-2026/Apple reports out-of-bounds writing in CoreGraphics and possible exploitation against specific targets. Analysis of the primitive and public unknowns.Thu, 05 Nov 2026 00:00:00 GMTBlogAppleiOSMemoryVulnerabilitiescontact@rootzero.eu (rootzero)VeloCloud Orchestrator: from standard account to superuser via SQL injectionhttps://rootzero.eu/en/research/arista-velocloud-sql-injection-superuser-2026/https://rootzero.eu/en/research/arista-velocloud-sql-injection-superuser-2026/Arista confirms SQL injection in VeloCloud Orchestrator. An authenticated user can impersonate a superuser operator.Thu, 05 Nov 2026 00:00:00 GMTBlogAristaSQL injectionNetworkVulnerabilitiescontact@rootzero.eu (rootzero)Auto-Planning: what the claimed automobile leak demonstrateshttps://rootzero.eu/en/research/auto-planning-claimed-vehicle-data-breach-2026/https://rootzero.eu/en/research/auto-planning-claimed-vehicle-data-breach-2026/An attacker claims access to millions of appointments and drivers' records. Analysis of the reported samples, risks and limits of public evidence.Thu, 05 Nov 2026 00:00:00 GMTBlogAuto-PlanningData breachAutomotiveInvestigationcontact@rootzero.eu (rootzero)BeyondTrust Remote Support: when an internal message could trigger file operationshttps://rootzero.eu/en/research/beyondtrust-remote-support-message-file-operations-2026/https://rootzero.eu/en/research/beyondtrust-remote-support-message-file-operations-2026/CVE-2026-102764 allowed operations on BeyondTrust appliance files. Mandiant traces its exploitation, persistence and traces to look for.Thu, 05 Nov 2026 00:00:00 GMTBlogBeyondTrustAppliancesIncidentsVulnerabilitiescontact@rootzero.eu (rootzero)Black October: why AI platforms became vaults for valuable keyshttps://rootzero.eu/en/research/black-october-ai-platform-key-theft-2026/https://rootzero.eu/en/research/black-october-ai-platform-key-theft-2026/Wiz identifies several AI platform incidents. We examine their shared patterns, distinct causes and why attackers seek environment variables.Thu, 05 Nov 2026 00:00:00 GMTBlogAICloudSecretsIncidentscontact@rootzero.eu (rootzero)Cisco ASA and FTD: A VPN request can restart the firewallhttps://rootzero.eu/en/research/cisco-asa-ftd-vpn-reboot-2026/https://rootzero.eu/en/research/cisco-asa-ftd-vpn-reboot-2026/Cisco confirms active exploitation of CVE-2026-76418. A crafted SSL VPN request may restart ASA or FTD when secondary authentication is configured.Thu, 05 Nov 2026 00:00:00 GMTBlogCiscoVPNAvailabilityVulnerabilitiescontact@rootzero.eu (rootzero)NetScaler: a hidden command in logs and an overflowed DTLS bufferhttps://rootzero.eu/en/research/citrix-netscaler-logs-dtls-exploitation-2026/https://rootzero.eu/en/research/citrix-netscaler-logs-dtls-exploitation-2026/CVE-2026-88771 and -88772 affect NetScaler. Analysis of command injection through logs and a buffer overflow during DTLS reassembly.Thu, 05 Nov 2026 00:00:00 GMTBlogCitrixNetScalerRCENetworkcontact@rootzero.eu (rootzero)ConnectWise Cloud Backup: An application identity opens Microsoft 365 tenantshttps://rootzero.eu/en/research/connectwise-cloud-backup-app-identities-2026/https://rootzero.eu/en/research/connectwise-cloud-backup-app-identities-2026/Compromised ConnectWise app credentials enabled Microsoft 365 sign-ins and Graph actions in some tenants. We trace the trust boundary and scope.Thu, 05 Nov 2026 00:00:00 GMTBlogConnectWiseMicrosoft 365OAuthSupply chaincontact@rootzero.eu (rootzero)Drupal Commerce: an order can become an authorization problemhttps://rootzero.eu/en/research/drupal-commerce-order-access-control-2026/https://rootzero.eu/en/research/drupal-commerce-order-access-control-2026/Drupal confirms exploitation of CVE-2026-118539, insufficiently protected access to Commerce Core routes and fields. Financial risk, investigation and corrective action.Thu, 05 Nov 2026 00:00:00 GMTBlogDrupalCommerceAccess controlVulnerabilitiescontact@rootzero.eu (rootzero)Fireworks AI: evaluation job secrets accessible after credential thefthttps://rootzero.eu/en/research/fireworks-evaluation-job-secret-exposure-2026/https://rootzero.eu/en/research/fireworks-evaluation-job-secret-exposure-2026/Fireworks AI confirms unauthorized access to evaluation job variables in some customer accounts. We examine the secret boundary, known scope and rotation.Thu, 05 Nov 2026 00:00:00 GMTBlogFireworks AIAISecretsIncidentscontact@rootzero.eu (rootzero)Ivanti Connect Secure: three boundaries crossed to reach roothttps://rootzero.eu/en/research/ivanti-connect-secure-zero-day-chain-2026/https://rootzero.eu/en/research/ivanti-connect-secure-zero-day-chain-2026/Volexity reconstructed the chain exploited against Ivanti Connect Secure: CGI routing, executable temporary file, then privileged broker. Analysis and scope.Thu, 05 Nov 2026 00:00:00 GMTBlogIvantiVPNRCEIncidentscontact@rootzero.eu (rootzero)Artifactory: an administrator token can become a door to the supply chainhttps://rootzero.eu/en/research/jfrog-artifactory-admin-token-persistence-2026/https://rootzero.eu/en/research/jfrog-artifactory-admin-token-persistence-2026/JFrog describes a default authentication bypass and Wiz observes its exploitation. Analysis of admin tokens, Groovy plugins and persistent risks after patch.Thu, 05 Nov 2026 00:00:00 GMTBlogJFrogSupply chainAuthenticationIncidentscontact@rootzero.eu (rootzero)Langflow: how auto-login and code filtering exposed an execution pathhttps://rootzero.eu/en/research/langflow-auto-login-mcp-code-execution-2026/https://rootzero.eu/en/research/langflow-auto-login-mcp-code-execution-2026/The Langflow vulnerabilities of October 2026 affect the authentication and execution of Python components. Analysis of public PoC, limits and fix.Thu, 05 Nov 2026 00:00:00 GMTBlogLangflowAIMCPRCEcontact@rootzero.eu (rootzero)LXD: a public certificate was enough to borrow a trusted identityhttps://rootzero.eu/en/research/lxd-certificate-chain-trust-2026/https://rootzero.eu/en/research/lxd-certificate-chain-trust-2026/CVE-2026-112816 allowed a client to append a trusted public certificate to its TLS chain. We explain the faulty authorization check and its impact.Thu, 05 Nov 2026 00:00:00 GMTBlogLXDTLSAuthenticationVulnerabilitiescontact@rootzero.eu (rootzero)Node.js and Brotli: a format error became an out-of-bounds writehttps://rootzero.eu/en/research/node-brotli-out-of-bounds-decoder-2026/https://rootzero.eu/en/research/node-brotli-out-of-bounds-decoder-2026/Node.js' Brotli decoder could write past an eight-byte buffer. We explain the streaming state error, memory corruption and exposure conditions.Thu, 05 Nov 2026 00:00:00 GMTBlogNode.jsBrotliMemoryRCEcontact@rootzero.eu (rootzero)Node.js: why two processes could generate the same UUIDshttps://rootzero.eu/en/research/node-snapshot-repeated-uuid-2026/https://rootzero.eu/en/research/node-snapshot-repeated-uuid-2026/Node.js snapshots could freeze the randomUUID and randomInt cache. Explanation of collisions, preconditions and correction.Thu, 05 Nov 2026 00:00:00 GMTBlogNode.jsCryptographieSnapshotsVulnerabilitiescontact@rootzero.eu (rootzero)Node.js TLS: multiple spellings of an IP, conflicting security decisionshttps://rootzero.eu/en/research/node-tls-ip-certificate-normalization-2026/https://rootzero.eu/en/research/node-tls-ip-certificate-normalization-2026/Three Node.js CVEs show how host resolution and certificate validation can interpret a non-canonical IP address differently.Thu, 05 Nov 2026 00:00:00 GMTBlogNode.jsTLSCertificatsVulnerabilitiescontact@rootzero.eu (rootzero)NVIDIA Brev: SSH keys potentially exposed, how to check the real riskhttps://rootzero.eu/en/research/nvidia-brev-possible-ssh-key-exposure-2026/https://rootzero.eu/en/research/nvidia-brev-possible-ssh-key-exposure-2026/Reported customer notifications suggest unauthorized activity on Brev and possible exposure of SSH keys. What is documented and what remains to be established.Thu, 05 Nov 2026 00:00:00 GMTBlogNVIDIABrevSSHCloudcontact@rootzero.eu (rootzero)Plex: four linked flaws turn a URL into code executionhttps://rootzero.eu/en/research/plex-ssrf-token-file-write-rce-2026/https://rootzero.eu/en/research/plex-ssrf-token-file-write-rce-2026/Plex confirms active exploitation of four related flaws. We trace the SSRF, loopback access, admin token disclosure and file write that lead to RCE.Thu, 05 Nov 2026 00:00:00 GMTBlogPlexSSRFRCEVulnerabilitiescontact@rootzero.eu (rootzero)Railway: how a build intrusion reached encrypted secretshttps://rootzero.eu/en/research/railway-build-decrypted-secrets-2026/https://rootzero.eu/en/research/railway-build-decrypted-secrets-2026/Railway describes privilege escalation in its build infrastructure, followed by access to encrypted and decrypted environment variables. Timeline and scope.Thu, 05 Nov 2026 00:00:00 GMTBlogRailwayCloudCI/CDSecretscontact@rootzero.eu (rootzero)SAP OVERPASS and S4GET: two unauthenticated paths into the ERP corehttps://rootzero.eu/en/research/sap-overpass-s4get-trust-boundaries-2026/https://rootzero.eu/en/research/sap-overpass-s4get-trust-boundaries-2026/Two critical SAP vulnerabilities affect the trace passport and the Message Server trust. Analysis of boundaries, scope and unknowns.Thu, 05 Nov 2026 00:00:00 GMTBlogSAPERPRCEVulnerabilitiescontact@rootzero.eu (rootzero)Siemens Software Center: a signed executable loaded the attacker’s DLLhttps://rootzero.eu/en/research/siemens-software-center-dll-sideloading-2026/https://rootzero.eu/en/research/siemens-software-center-dll-sideloading-2026/A campaign distributed a genuine Siemens executable alongside a malicious DLL. We explain the loading path, preconditions and available evidence.Thu, 05 Nov 2026 00:00:00 GMTBlogSiemensWindowsDLLIncidentscontact@rootzero.eu (rootzero)So-net: distinguish 2.14 million profiles and exposed email passwordshttps://rootzero.eu/en/research/sonet-profile-mail-password-breach-2026/https://rootzero.eu/en/research/sonet-profile-mail-password-breach-2026/The So-net incident exposed subscriber profiles, plala records and passwords for certain mail services. We separate the counts, risks and unknowns.Thu, 05 Nov 2026 00:00:00 GMTBlogSo-netData breachEmailJapancontact@rootzero.eu (rootzero)Sourcenext: what 22.5 million potentially exposed records meanhttps://rootzero.eu/en/research/sourcenext-22-5m-potential-records-2026/https://rootzero.eu/en/research/sourcenext-22-5m-potential-records-2026/Sourcenext announces 22,519,960 records potentially affected, with passwords among the possible fields. What this number actually means.Thu, 05 Nov 2026 00:00:00 GMTBlogSourcenextData breachIdentityJapancontact@rootzero.eu (rootzero)Vacaf: 1.62 million beneficiaries affected, and the sensitivity of a family filehttps://rootzero.eu/en/research/vacaf-cnaf-family-data-breach-2026/https://rootzero.eu/en/research/vacaf-cnaf-family-data-breach-2026/Cnaf puts the number of beneficiaries affected by the Vacaf incident at 1,619,893. What data was captured, what concrete risks and what do we know about the cause?Thu, 05 Nov 2026 00:00:00 GMTBlogVacafCnafPersonal dataIncidentcontact@rootzero.eu (rootzero)VMware ESX: a low-severity logging flaw with an investigative costhttps://rootzero.eu/en/research/vmware-esx-logging-blind-spot-2026/https://rootzero.eu/en/research/vmware-esx-logging-blind-spot-2026/Broadcom rates an ESX logging weakness at 2.7: Some operations by a malicious administrator may not be traced. Impact and investigation.Thu, 05 Nov 2026 00:00:00 GMTBlogVMwareESXJournauxVulnerabilitiescontact@rootzero.eu (rootzero)WordPress: the race between extraction and cleanup during an updatehttps://rootzero.eu/en/research/wordpress-update-race-rce-2026/https://rootzero.eu/en/research/wordpress-update-race-rce-2026/A WordPress core archive extracted into a predictable web-served directory created an RCE window. We explain the race, conditions and fixes.Thu, 05 Nov 2026 00:00:00 GMTBlogWordPressRCEWebVulnerabilitiescontact@rootzero.eu (rootzero)Zeabur: non-expiring tokens, 101 root servers and a key reappearing in backupshttps://rootzero.eu/en/research/zeabur-tokens-cluster-backup-exposure-2026/https://rootzero.eu/en/research/zeabur-tokens-cluster-backup-exposure-2026/Zeabur documents two intrusion paths, plaintext tokens, root access to 101 servers and a rotated key exposed through a backup. We trace the chain.Thu, 05 Nov 2026 00:00:00 GMTBlogZeaburCloudSecretsIncidentscontact@rootzero.eu (rootzero)AI agent memory: writing, updating, forgetting and verificationhttps://rootzero.eu/en/research/ai-agent-memory-lifecycle/https://rootzero.eu/en/research/ai-agent-memory-lifecycle/Design AI-agent memory with task state, facts, provenance, contradictions, expiry and deletion. Security checks and research references.Wed, 04 Nov 2026 00:00:00 GMTBlogAIMemoryArchitectureSecuritycontact@rootzero.eu (rootzero)Arkéa: fraudulent transfers through a vendor, with customer accounts unaffectedhttps://rootzero.eu/en/research/arkea-prestataire-virements-frauduleux-2026/https://rootzero.eu/en/research/arkea-prestataire-virements-frauduleux-2026/Crédit Mutuel Arkéa reports a vendor-platform intrusion and transfers from the bank’s own account. What is known, and which payment trust boundaries need investigation.Wed, 04 Nov 2026 00:00:00 GMTBlogBankingVendorFraudIncidentcontact@rootzero.eu (rootzero)Binance: $6.34 billion affected without a confirmed private-key leakhttps://rootzero.eu/en/research/binance-signature-portefeuille-eip7702-2026/https://rootzero.eu/en/research/binance-signature-portefeuille-eip7702-2026/From a fake job interview to a wallet signing service and persistent EIP-7702 delegation: the technical chain reported by Binance and its limits.Wed, 04 Nov 2026 00:00:00 GMTBlogCryptoSupply chainEIP-7702Incidentcontact@rootzero.eu (rootzero)Free cybersecurity tools: choose by task and evidencehttps://rootzero.eu/en/research/browser-cybersecurity-tools/https://rootzero.eu/en/research/browser-cybersecurity-tools/Choose free browser security tools for JWTs, HTTP, OpenAPI, IOCs, CVSS and evidence. Practical workflows and the limitations of local processing.Wed, 04 Nov 2026 00:00:00 GMTBlogToolsWebAPIMethodcontact@rootzero.eu (rootzero)Coinbase and Amplitude: the breach was at the vendor, the risk reaches customershttps://rootzero.eu/en/research/coinbase-amplitude-fuite-donnees-2026/https://rootzero.eu/en/research/coinbase-amplitude-fuite-donnees-2026/Coinbase confirms customer information was affected at analytics vendor Amplitude. We separate verified scope, unknown intrusion method and phishing risk.Wed, 04 Nov 2026 00:00:00 GMTBlogCoinbaseData exposureSupply chainIncidentcontact@rootzero.eu (rootzero)Context engineering: budgets, evidence and agent compactionhttps://rootzero.eu/en/research/context-engineering-budgets-compaction/https://rootzero.eu/en/research/context-engineering-budgets-compaction/Organise AI-agent context with token budgets, task state, tool outputs, evidence references and compaction. A security example and restart checks.Wed, 04 Nov 2026 00:00:00 GMTBlogAIContextArchitectureMethodcontact@rootzero.eu (rootzero)Cybersecurity AI agents and multi-agent systems: what to assesshttps://rootzero.eu/en/research/cybersecurity-ai-agents-multi-agent/https://rootzero.eu/en/research/cybersecurity-ai-agents-multi-agent/Compare assistants, cybersecurity AI agents and multi-agent systems. Assess tool permissions, evidence, isolation and limitations before running a pilot.Wed, 04 Nov 2026 00:00:00 GMTBlogAIPentestMethodcontact@rootzero.eu (rootzero)Cybersecurity RSS monitoring: from sources to remediationhttps://rootzero.eu/en/research/cybersecurity-rss-monitoring/https://rootzero.eu/en/research/cybersecurity-rss-monitoring/Build RSS-based security monitoring for a team or MSP: source selection, asset inventory, deduplication, qualification and evidence of remediation.Wed, 04 Nov 2026 00:00:00 GMTBlogMonitoringToolsMethodcontact@rootzero.eu (rootzero)The private key was 4: how eight eMudhra intermediate CAs lost their secrethttps://rootzero.eu/en/research/emudhra-cle-privee-quatre/https://rootzero.eu/en/research/emudhra-cle-privee-quatre/Eight eMudhra intermediate CA keys fit in one byte. This analysis explains discovery, certificate forgery risk, browser response and the unresolved root cause.Wed, 04 Nov 2026 00:00:00 GMTBlogPKITLSCryptographyIncidentcontact@rootzero.eu (rootzero)Enterprise RAG: architecture, access control and evaluationhttps://rootzero.eu/en/research/enterprise-rag-architecture-access-evaluation/https://rootzero.eu/en/research/enterprise-rag-architecture-access-evaluation/Design traceable RAG with ingestion, revisions, authorisation, retrieval, context and citations. A security example and reproducible offline demonstration.Wed, 04 Nov 2026 00:00:00 GMTBlogAIRAGArchitectureSecuritycontact@rootzero.eu (rootzero)Evaluating cybersecurity AI agents: tasks, evidence and denominatorshttps://rootzero.eu/en/research/evaluating-cyber-ai-agents-evidence-metrics/https://rootzero.eu/en/research/evaluating-cyber-ai-agents-evidence-metrics/Build cyber-agent evaluations with scope, ground truth, precision, recall, abstention, unwanted effects and reproducible comparisons.Wed, 04 Nov 2026 00:00:00 GMTBlogAIEvaluationPentestMethodcontact@rootzero.eu (rootzero)Connected refrigeration: how remote settings can break a cold chainhttps://rootzero.eu/en/research/froid-connecte-attaque-controleurs-2026/https://rootzero.eu/en/research/froid-connecte-attaque-controleurs-2026/CERT-FR confirms compromises of refrigeration controllers. The network path, defrost settings, physical effects and limits of the evidence explained.Wed, 04 Nov 2026 00:00:00 GMTBlogOTIoTIndustryIncidentcontact@rootzero.eu (rootzero)GitLab: when compiling a regular expression can compromise the serverhttps://rootzero.eu/en/research/gitlab-ruby-regexp-rce-2026/https://rootzero.eu/en/research/gitlab-ruby-regexp-rce-2026/Four GitLab CVEs expose memory corruption in Ruby Onigmo. This analysis separates user input, native compilation, demonstrated impact and patch requirements.Wed, 04 Nov 2026 00:00:00 GMTBlogGitLabRubyRCEVulnerabilitiescontact@rootzero.eu (rootzero)GraphRAG for cybersecurity: relationships, sources and permissionshttps://rootzero.eu/en/research/graphrag-security-knowledge-graphs/https://rootzero.eu/en/research/graphrag-security-knowledge-graphs/Assess GraphRAG for security knowledge: local and global questions, relationship provenance, indexing costs, source changes and customer isolation.Wed, 04 Nov 2026 00:00:00 GMTBlogAIRAGGraphsSecuritycontact@rootzero.eu (rootzero)LiteLLM: from a forgotten Git secret to a signed malicious releasehttps://rootzero.eu/en/research/litellm-release-empoisonnee-2026/https://rootzero.eu/en/research/litellm-release-empoisonnee-2026/LiteLLM 1.107.0 delivered malware through PyPI and Docker. The incident traces a public secret, owner token, altered build source and valid signatures.Wed, 04 Nov 2026 00:00:00 GMTBlogSupply chainGitHub ActionsSecretsIncidentcontact@rootzero.eu (rootzero)Multi-agent systems: contracts, orchestration and recoveryhttps://rootzero.eu/en/research/multi-agent-contracts-orchestration/https://rootzero.eu/en/research/multi-agent-contracts-orchestration/Design verifiable multi-agent systems with task contracts, typed results, evidence, permissions, idempotency, budgets and recovery. A security workflow.Wed, 04 Nov 2026 00:00:00 GMTBlogAIMulti-agentArchitectureMethodcontact@rootzero.eu (rootzero)Paint and RCE: how an image reader becomes an attack surfacehttps://rootzero.eu/en/research/paint-rce-lecture-hors-limites-2026/https://rootzero.eu/en/research/paint-rce-lecture-hors-limites-2026/Microsoft rates a Paint out-of-bounds read as RCE. The public record does not reveal the exploit chain; here is what the memory bug and fix actually establish.Wed, 04 Nov 2026 00:00:00 GMTBlogWindowsPaintRCEVulnerabilitiescontact@rootzero.eu (rootzero)PHP2Shell: two memory bugs at the boundary between PHP requestshttps://rootzero.eu/en/research/php2shell-deux-bugs-cycle-requete/https://rootzero.eu/en/research/php2shell-deux-bugs-cycle-requete/How multipart parsing, abrupt out-of-memory exits and stale worker state can lead to PHP code execution, with confirmed scope and fixed versions.Wed, 04 Nov 2026 00:00:00 GMTBlogPHPRCEMemory safetyVulnerabilitiescontact@rootzero.eu (rootzero)Hybrid RAG search: chunking, reranking and evidencehttps://rootzero.eu/en/research/rag-hybrid-search-chunking-reranking/https://rootzero.eu/en/research/rag-hybrid-search-chunking-reranking/Choose RAG retrieval for security documents: exact identifiers, lexical and vector search, rank fusion, reranking and evidence-level evaluation.Wed, 04 Nov 2026 00:00:00 GMTBlogAIRAGRetrievalAPIcontact@rootzero.eu (rootzero)RAG security: prompt injection, memory and tenant isolationhttps://rootzero.eu/en/research/rag-security-injection-memory/https://rootzero.eu/en/research/rag-security-injection-memory/Assess RAG security across hostile documents, persistent memory, permissions, caches and tools. Defensive test cases with expected evidence.Wed, 04 Nov 2026 00:00:00 GMTBlogAIRAGSecurityPentestcontact@rootzero.eu (rootzero)AI in red teaming: scope, working memory and autonomy levelshttps://rootzero.eu/en/research/ai-red-team-rules-of-work/https://rootzero.eu/en/research/ai-red-team-rules-of-work/Let AI understand the target, keep facts separate from hypotheses, and grant autonomy according to the real cost of a wrong action.Tue, 20 Oct 2026 00:00:00 GMTBlogAIRed TeamMethodologycontact@rootzero.eu (rootzero)MCP: design a precise, bounded and authorised tool serverhttps://rootzero.eu/en/research/build-a-useful-mcp-server-for-a-tool/https://rootzero.eu/en/research/build-a-useful-mcp-server-for-a-tool/An MCP server earns its keep when tools have precise actions, bounded outputs and real authorization. A practical method using a fictional read-only catalogue.Tue, 20 Oct 2026 00:00:00 GMTBlogAIMCPMethodologycontact@rootzero.eu (rootzero)Command-line detection: equivalent effects, syntax variants and telemetryhttps://rootzero.eu/en/research/cli-obfuscation-effects-signatures/https://rootzero.eu/en/research/cli-obfuscation-effects-signatures/Two command lines can produce the same output but leave different text in telemetry. A small lab method for testing CLI rules without claiming an EDR bypass.Tue, 20 Oct 2026 00:00:00 GMTBlogRed TeamDetectionLinuxCLIcontact@rootzero.eu (rootzero)init=/bin/bash: what a Linux login actually protectshttps://rootzero.eu/en/research/init-bin-bash-root-linux-boot/https://rootzero.eu/en/research/init-bin-bash-root-linux-boot/A boot parameter can launch Bash as PID 1 and give root, under specific conditions. An owned-VM exercise and the limits of GRUB, encryption, and Secure Boot.Tue, 20 Oct 2026 00:00:00 GMTBlogLinuxPhysical accessHardeningBootcontact@rootzero.eu (rootzero)VPN kill switches: fail-closed design and IP leak verificationhttps://rootzero.eu/en/research/vpn-kill-switch-prove-no-ip-leak/https://rootzero.eu/en/research/vpn-kill-switch-prove-no-ip-leak/A VPN route does not guarantee that your source IP stays hidden. Define a fail-closed policy and test DNS, IPv6 and reconnects against your own endpoint.Tue, 20 Oct 2026 00:00:00 GMTBlogRed TeamVPNNetworkOpSeccontact@rootzero.eu (rootzero)WPSplinter in France: scope of the Paris radio surveyhttps://rootzero.eu/en/research/wpsplinter-france-paris-survey/https://rootzero.eu/en/research/wpsplinter-france-paris-survey/Quentin Kaiser proved WPSplinter on Belgian gateways. His Paris radio survey flags French models, without measuring national exposure or proving RCE on them.Tue, 20 Oct 2026 00:00:00 GMTBlogWi-FiVulnerabilitiesFranceResearchcontact@rootzero.eu (rootzero)Attack surface mapping: CT logs, forgotten assets and typosquatshttps://rootzero.eu/en/research/forgotten-attack-surface/https://rootzero.eu/en/research/forgotten-attack-surface/Certificate Transparency, forgotten staging servers, open cloud storage, typosquats, SPF/DKIM/DMARC: what an attacker sees of you before you do.Wed, 14 Oct 2026 00:00:00 GMTBlogExposureNetworkWebGovernancecontact@rootzero.eu (rootzero)A CVSS score is not a riskhttps://rootzero.eu/en/research/cvss-is-not-risk/https://rootzero.eu/en/research/cvss-is-not-risk/CVSS measures technical severity and ignores your context. CVSS 3.1 and 4.0, EPSS, the CISA KEV catalogue: how to prioritise with data.Thu, 01 Oct 2026 00:00:00 GMTBlogVulnerabilitiesGovernanceDetectioncontact@rootzero.eu (rootzero)JWT: five implementation flaws and their fixeshttps://rootzero.eu/en/research/jwt-five-mistakes/https://rootzero.eu/en/research/jwt-five-mistakes/alg none, algorithm confusion, weak HMAC secrets, kid injection, tokens that never expire: five classic JWT mistakes and how to fix them.Thu, 17 Sep 2026 00:00:00 GMTBlogWebAPIAuthenticationcontact@rootzero.eu (rootzero)Detect and block reverse shells with Sysmon and auditdhttps://rootzero.eu/en/research/reverse-shells-detect-and-block/https://rootzero.eu/en/research/reverse-shells-detect-and-block/Why a reverse shell passes permissive egress filtering, and how to spot one: egress filtering, process lineage, Sysmon, auditd and EDR.Thu, 03 Sep 2026 00:00:00 GMTBlogDetectionNetworkSystemscontact@rootzero.eu (rootzero)