Blog Posts

A collection of writeups, debugging adventures, and technical experiments. If it broke my brain or made me curious, it probably ended up here.

2025

Dec 23, 2025When WebSockets Lead to RCE in CurseForge
An unauthenticated local WebSocket server in the CurseForge launcher allowed any website to trigger remote code execution via attacker-controlled JVM arguments.
#security #rce #research
Jul 6, 2025Supershy: Remote Code Execution in a VPN Client
How I found a RCE vulnerability in a privacy VPN.
#vpn #security #rce #research
May 5, 2025Lockbit Wallet Tracking
Scanned 62k Bitcoin addresses from the LockBit ransomware leak to see which wallets were funded. Here’s what I found.
#lockbit #crypto #malware #ransomware