JIT-Spray was one of the flagship primitives of the original DSecRG era. We already put up a heritage revisit of that work, with the Internet Archive link to the material as it stood around 2010.…
One unauthenticated POST, one arbitrary file on disk, one webshell. CVE-2025-31324 is a missing authorization check in SAP NetWeaver’s Visual Composer, and it carries the maximum CVSS score for the least interesting of reasons: the…
Two CVEs, one chain. CVE-2024-0012 is an authentication bypass in the PAN-OS management web interface; CVE-2024-9474 is a privilege escalation that ends at root. Neither is much alone. Bolt them together and a single unauthenticated…
A supply-chain reconstruction. In March 2025 something like 23,000 repositories pulled a compromised version of a GitHub Action for a couple of days, and the credential theft that followed is the boring part of the…
An n-day reconstruction. ToolShell is the SharePoint chain that ran through the second half of 2025, and it is worth the writeup for a reason that has nothing to do with the RCE itself. The…
SAP was the lane this site was known for, 2009 to 2012. Enterprise stack tradecraft; the components that sit in front of the business data and rarely get looked at hard. New team, new work,…