DSecRG publishes again, fourteen years after the original team went quiet. This post is the relaunch note; technical writeups start in the next one.
DSecRG covered offensive vulnerability research from 2009 to 2012. Site went quiet when the parent firm shifted commercial focus elsewhere; name stayed dormant. Subject area worth carrying. So the work continues, under a new team, fourteen years on.
What changed and what did not
Team is new. Small. What we research is what we write. Subject area — exploit chains, post-exploitation primitives, modern shellcoding, supply-chain CVE chains, the gap between vendor patches and what real attackers do — same as before. Lab setup is a real paragraph in every writeup, not a footnote. Vendors named, CVE-IDs linked to NVD, chain mechanics described in operational detail. No synth-marketing.
What this site is not
Not a continuation of the 2009-2012 team. We don’t speak for them, don’t claim continuity with their later commercial work, don’t reuse their advisories or names. Where a 2026 post revisits a 2009-2012 topic — JIT-Spray, SAP attack surface, Lotus Domino penetration, Python Arsenal for RE — the post is new writing on the same subject. Original research linked at the Internet Archive in each such piece.
Not a CVE-credit project either. Most posts will be n-day chain reconstructions and writeups; occasional original lab-confirmed work when something justifies it.
Schedule
Wednesdays. First four weeks lean on heritage-revisit pieces because that’s the natural bridge from what DSecRG was to what the next decade looks like. Week five onward, mix of new lab work, n-day reconstruction, commentary on disclosure patterns when something genuinely warrants it.
RSS at /feed/.
Contact
[email protected] — tips, corrections, name concerns, research collaboration. If you worked on the original 2009-2012 DSecRG and want anything changed in how heritage is framed, same address reaches us.