Skip to content

Jacob Strix

CEO / Security Researcher

Leads Egnworks' research and offensive engagements. Code auditor by training. Red team operator by choice. Vulnerability researcher by obsession.

25 articles so far

Generated Egnworks banner describing the MikroTrick RouterOS SSH vulnerability chain

Security

MikroTrick Hijacks MikroTik Routers Over SSH

MikroTrick chains two RouterOS SSH flaws for unauthenticated administrator access. Reproduce the broken RSA check safely, then patch and investigate.

Jacob Strix

A dark Egnworks security banner representing a repository API escaping into the GitLab server filesystem.

Security

GitLab CVE-2026-85706 Exposes Server Files

GitLab fixed 18 vulnerabilities, led by an unauthenticated CVSS 10.0 file-read flaw, GraphQL credential exposure, and an Advanced Search RCE.

Jacob Strix

A dark Egnworks banner representing malicious instructions taking control of an AI coding agent.

Reverse Engineering

DUSTMAKER Malware Hijacks AI Coding Agents

Reverse engineer how DUSTMAKER turns trusted AI coding files and CI workflows into execution, credential theft, persistence, and propagation paths.

Jacob Strix

A dark Egnworks security banner representing malicious style data crossing into Magento template execution.

Security

CVE-2026-75650 StyleSmuggler Magento RCE

A technical analysis of CVE-2026-75650, the actively exploited Magento template injection that gives unauthenticated attackers remote code execution.

Jacob Strix

A Red Team visualization of one compromised Windows cluster node exposing every connected node and virtual identity.

Red Team

Own One Node, Own the Cluster

A Red Team analysis of how WSFC identities, RBCD, shared secrets, and BloodHound paths turn one compromised node into cluster-wide control.

Jacob Strix

A Red Team banner depicting two Active Directory identities converging inside a Kerberos authentication path.

Red Team

ResetNightmare: When a Writable UPN Becomes Domain Admin

A technical Red Team analysis of ResetNightmare, where writable UPN attributes, Kerberos name confusion, and kpasswd can create a domain takeover path.

Jacob Strix