ISSUEN°11 ·2026
N°11 · AI-RESEARCH · 2026-08-07 · 9 MIN READ · SEVERITY MEDIUM 6.2
I pointed my own multi-agent review system at my own dependency tree — re2 and stream-json, about 12.1M npm downloads a week between them. Four accepted advisories came out, and this is the honest account of how, including the parts where the process nearly threw a finding away.
N°10 · AI-RESEARCH · 2026-06-21
Single-agent AI review states hallucinations with the same confidence as real findings, and never learns. Gossipcat makes agents verify each other against the source, and turns the verdicts into reward signal.
N°09 · VULNERABILITY-RESEARCH · 2021-02-06
Root cause analysis of a silently patched stack overflow in svl.dll, reversed out of Microsoft SQL Server and rebuilt into a working proof of concept.
N°08 · WRITEUP · 2019-09-02
The most educational box I have solved — an SSH-tunneled admin panel, a hijacked APT repository, and a chain that only works if each step is understood, not copied.
N°07 · WRITEUP · 2019-08-03
OpenBSD, so nothing behaves as expected: command injection into an authpf-gated network, an NFS export that leaks a private key, and pgAdmin credentials for the final step.
N°06 · PENTEST · 2019-05-13
Module vs library hijacking in Python, and why sys.path order is a privilege escalation primitive when a root process imports the wrong file first.
N°05 · WRITEUP · 2019-05-06
Two TSG CTF forensics challenges, both about git internals — recovering a flag from objects a committer thought they had obliterated.