Skip to content

Security

14 articles, newest first.

Vulnerability research, exploit development, and the CVE writeups we publish once a patch has shipped and the risk is understood.

Generated Egnworks banner describing the MikroTrick RouterOS SSH vulnerability chain

Security

MikroTrick Hijacks MikroTik Routers Over SSH

MikroTrick chains two RouterOS SSH flaws for unauthenticated administrator access. Reproduce the broken RSA check safely, then patch and investigate.

Jacob Strix

A dark Egnworks security banner representing a repository API escaping into the GitLab server filesystem.

Security

GitLab CVE-2026-85706 Exposes Server Files

GitLab fixed 18 vulnerabilities, led by an unauthenticated CVSS 10.0 file-read flaw, GraphQL credential exposure, and an Advanced Search RCE.

Jacob Strix

A dark Egnworks security banner representing malicious style data crossing into Magento template execution.

Security

CVE-2026-75650 StyleSmuggler Magento RCE

A technical analysis of CVE-2026-75650, the actively exploited Magento template injection that gives unauthenticated attackers remote code execution.

Jacob Strix

A laptop displays source code during an investigation into compromised npm packages.

Security

ChainDrop Poisoned the npm Supply Chain

ChainDrop turned trusted npm releases into a self-propagating credential stealer across Keyv, Cacheable, and hundreds of downstream packages.

Jacob Strix

wp2shell CVE-2026-63030 Unauthenticated RCE in WordPress Core

Security

wp2shell CVE-2026-63030 Unauthenticated RCE in WordPress Core

How wp2shell chains two WordPress core bugs into unauthenticated RCE with a full exploit walkthrough SIEM detection and the patch for CVE-2026-63030 and CVE-2026-60137.

Jacob Strix

Pickle Deserialization RCE How a Malicious AI Model Runs Code the Moment You Load It

Security

Pickle Deserialization RCE How a Malicious AI Model Runs Code the Moment You Load It

How a malicious AI model runs code on load through pickle deserialization. Real CVEs a working PoC SIEM detection and the safetensors fix.

Jacob Strix