Latest technical write-up
AI in red teaming: scope, working memory and autonomy levels
Let AI understand the target, keep facts separate from hypotheses, and grant autonomy according to the real cost of a wrong action.
Read the write-upThe technical blog
of the lab.
We document vulnerability research and lab experiments, including the commands used, observed results and test limitations.
Articles, notes and vulnerabilities
Mechanisms, hypotheses, evidence, limits and fixes.
AI in red teaming: scope, working memory and autonomy levels
Let AI understand the target, keep facts separate from hypotheses, and grant autonomy according to the real cost of a wrong action.
4 min · rootzero
MCP: design a precise, bounded and authorised tool server
An MCP server earns its keep when tools have precise actions, bounded outputs and real authorization. A practical method using a fictional read-only catalogue.
7 min · rootzero
Command-line detection: equivalent effects, syntax variants and telemetry
Two command lines can produce the same output but leave different text in telemetry. A small lab method for testing CLI rules without claiming an EDR bypass.
3 min · rootzero
init=/bin/bash: what a Linux login actually protects
A boot parameter can launch Bash as PID 1 and give root, under specific conditions. An owned-VM exercise and the limits of GRUB, encryption, and Secure Boot.
5 min · rootzero
VPN kill switches: fail-closed design and IP leak verification
A VPN route does not guarantee that your source IP stays hidden. Define a fail-closed policy and test DNS, IPv6 and reconnects against your own endpoint.
4 min · rootzero
WPSplinter in France: scope of the Paris radio survey
Quentin Kaiser proved WPSplinter on Belgian gateways. His Paris radio survey flags French models, without measuring national exposure or proving RCE on them.
5 min · rootzero
Attack surface mapping: CT logs, forgotten assets and typosquats
Certificate Transparency, forgotten staging servers, open cloud storage, typosquats, SPF/DKIM/DMARC: what an attacker sees of you before you do.
6 min · rootzero
Autonomous offensive agents: scope guardrails
Allowlists, DNS rebinding, redirects, rate limiting, destructive action classes, kill switch, audit log and the human role for autonomous testing agents.
9 min · rootzero
A CVSS score is not a risk
CVSS measures technical severity and ignores your context. CVSS 3.1 and 4.0, EPSS, the CISA KEV catalogue: how to prioritise with data.
6 min · rootzero
JWT: five implementation flaws and their fixes
alg none, algorithm confusion, weak HMAC secrets, kid injection, tokens that never expire: five classic JWT mistakes and how to fix them.
6 min · rootzero
LMDeployCVE-2026-33625Code execution in LMDeploy through eval() of a model’s quant_dtype
A crafted quantization_config in a Hugging Face model made LMDeploy pass quant_dtype to eval(), so loading the model ran the attacker’s Python code.
8 min · rootzero
ShopEngine (Elementor WooCommerce Builder)CVE-2026-85575Stored XSS in ShopEngine through the product title heading tag
Our Author-role PoC confirmed stored XSS in ShopEngine 4.8.9, from Elementor storage to execution in a visitor’s browser.
4 min · rootzero
Vulnerability validation cycle: from hypothesis to reproducible evidence
Method note: hypothesis, attempt, observed response, independent verification, replayable re-test. A finding without proof remains an alert to be triaged.
8 min · rootzero
Microsoft WindowsCVE-2026-68896Local privilege escalation in the Windows Search component
Our Windows Search investigation, from the multi-session catalogue gate to a verified SYSTEM delete and a carefully bounded code-execution chain.
5 min · rootzero
Microsoft WindowsCVE-2026-81963Local privilege escalation in the Windows Update Stack through link following
How our CVE-2020-0728 variant hunt led from a false CBS lead to a reproducible TrustedInstaller write and SYSTEM elevation.
5 min · rootzero
Detect and block reverse shells with Sysmon and auditd
Why a reverse shell passes permissive egress filtering, and how to spot one: egress filtering, process lineage, Sysmon, auditd and EDR.
8 min · rootzero
Royal Addons for ElementorCVE-2026-6504 +5Six stored XSS in WordPress plugins: when a tag name becomes an attack vector
Variant analysis of six WordPress plugins that printed an HTML tag name chosen by a Contributor without an allow-list, each leading to stored XSS.
11 min · rootzero
LibreNMSCVE-2026-84191Stored XSS in LibreNMS through SNMP-sourced VRF names and descriptions
LibreNMS rendered VRF names, descriptions and route distinguishers polled over SNMP without escaping, so a rogue device could run script in an operator’s browser.
7 min · rootzero
FreeCADCVE-2026-34398, CVE-2026-34399Code execution through eval() in the FreeCAD BIM workbench
Two eval() calls in the FreeCAD BIM workbench ran Python read from project and drawing templates, so loading a crafted template executed attacker code.
8 min · rootzero
MCP AtlassianCVE-2026-77262
Arbitrary file read in MCP Atlassian through confluence_upload_attachment
MCP Atlassian opened any file_path passed to its Confluence upload tool, so a caller could read host files and push them out as attachments.
8 min · rootzero
CoolifyCVE-2026-34049Command injection in Coolify MongoDB backups, an incomplete fix of CVE-2025-66209
The CVE-2025-66209 fix escaped database names in Coolify backups but not MongoDB collection names, which still reached a root shell on the server.
6 min · rootzero
OpenCTICVE-2026-35211Painless script injection in OpenCTI through the GraphQL script filter operator
Any OpenCTI user with the KNOWLEDGE capability could send raw Painless scripts to Elasticsearch through a public filter operator and exhaust the cluster.
6 min · rootzero
MONAIGHSA-wg9g-w2j2-8pgrCode execution in MONAI through pickled NumPy files read by NumpyReader
MONAI’s NumpyReader loaded .npy and .npz files with allow_pickle=True, so a poisoned file in a medical imaging dataset ran code on load.
7 min · rootzero
DbGateCVE-2026-48017Remote code execution in DbGate through the loadReader endpoint
Any authenticated DbGate user could inject JavaScript into a script the server forks, then escape the require = null sandbox with process.binding.
5 min · rootzero
DokployCVE-2026-45662Command injection in Dokploy through the registry URL on docker logout
Dokploy escaped the registry URL for docker login but not for docker logout, so deleting a crafted registry ran shell commands on the host.
6 min · rootzero
JupyterHubCVE-2026-40864XSRF bypass in JupyterHub through Sec-Fetch-Mode: no-cors requests
JupyterHub 4.1.0 to 5.4.4 skipped its XSRF check for any no-cors request, so a page on another origin could submit Hub forms for a logged-in user.
8 min · rootzero
DagsterCVE-2026-41490SQL injection in Dagster database I/O managers through dynamic partition keys
Dagster’s DuckDB, Snowflake, BigQuery and DeltaLake I/O managers copied dynamic partition keys into SQL, so adding a partition was enough to inject queries.
8 min · rootzero
Chamilo LMSCVE-2026-33715Unauthenticated SSRF and open mail relay in Chamilo LMS through install.ajax.php
A leftover installer endpoint in Chamilo LMS 2.0 let anyone make the server open SMTP connections to any host and send mail through it.
7 min · rootzero
Chamilo LMSCVE-2026-34160Unauthenticated SSRF in the Chamilo LMS PENS plugin through package and callback URLs
The PENS endpoint of Chamilo LMS 2.0 fetched package URLs and posted callbacks to addresses chosen by anyone, internal hosts and cloud metadata included.
9 min · rootzero
Netgate pfSensepfSense-SA-26_03.webguiPfSense-SA-26_03: stored XSS in the ARP table through a DHCP-supplied hostname
A DHCP client on the local network could store a hostname carrying JavaScript that ran in a pfSense administrator’s browser when they opened the ARP table.
4 min · rootzero
KubeAICVE-2026-34940OS command injection in KubeAI through the Ollama startup probe
A user allowed to create KubeAI Model resources could run shell commands inside model pods by adding metacharacters to the model URL.
8 min · rootzero
PlunkCVE-2026-34975Email header injection in Plunk through raw MIME construction in SESService
Plunk copied the sender name, subject, custom headers and attachment names into raw MIME without filtering line breaks, letting API users add headers.
7 min · rootzero
Azure Data Explorer MCP ServerCVE-2026-33980
KQL injection in Azure Data Explorer MCP Server through table_name
Three metadata tools of adx-mcp-server pasted table_name into KQL, letting an agent run arbitrary queries without going through execute_query.
7 min · rootzero
GraphitiCVE-2026-32247Cypher injection in Graphiti through search filter node labels
Graphiti pasted search filter node labels into raw Cypher, allowing a caller to bypass group filtering; writes depend on the database route and permissions.
9 min · rootzero
No publications match your search.