analyzereversedisclose
> Independent analysis of 0-days, n-days, and malware — written for operators and the people who write the advisories.
The three newest published write-ups. The rest live in the archive.
Independent loopback labs of PHP2Shell. CVE-2026-109618 is an OOM longjmp during multipart parse before application code. CVE-2026-109619 is a same-worker UAF on a stale fatal backtrace. Last-affected Apache mod_php vs patched 8.4.27 / 8.5.12. Advisory RCE inferred. Lab class is OOM abort and UAF/Crash.
Apache Superset 6.1.0 default Gamma posts unversioned dashboard JSON and overwrites a granted dataset's SQL. Chart/data then runs that query on the analytics connection. No sql_lab. No Dataset write. A dashboard editor can hide a query in a trusted chart. No CVE yet.
Stirling-PDF 3.2.0 import-database denylist is CREATE(FORCE)?ALIAS. CREATE OR REPLACE ALIAS still RUNSCRIPTs a Java alias. Backup download contains attacker SQL. GHSA-mrr8 closed the original strings. No CVE yet.
03 of 189Showing the newest 3. 186 more published notes are in the archive.
Open archive→Repos that came out of the write-ups. Open GitHub from here if that is what you came for.
Spicy malware. Full kill-chain implant: exploit, escalate, pivot, poison, C2. Windows 10/11 x64 Rust source, released as-is and slightly broken on purpose.
Late-90s IRC TUI that re-keys the Fortinet Hunter Nuitka gate. Static unpack, XOR unmask, Docker cage. The ELF never runs on the host.
02 of 04Showing the newest 2. 2 more repos are in the tree.
Open the tree→PDFs I actually reopen. Shelf notes in my voice, then the book.
Elnaz Rabieinejad, Ali Dehghantanha, Fattane Zarrinkalam, and Sarina Dastgerdy
Twenty SOC practitioners, not a vendor deck. LLMs as drafts and leads for logs and first-pass triage. Nobody in the room trusted them for the high-stakes call.
Alex Matrosov, Eugene Rodionov, and Sergey Bratus
The book I hand people when they ask why the kernel still believes the firmware. Boot path, UEFI, and the malware that lives underneath the OS you thought you were analyzing.
02 of 03Showing the newest 2. 1 more shelf note is in the room.
Open the room→Four lanes. Same standard: enough technical depth to be useful, without turning the site into a drop.
Fresh findings, coordinated when they need to be, written when they are ready.
What the advisory left out — leftover packages, composition, and still-live primitives.
Loaders, C2, host fitness, persistence. Behavioral tells a SOC can actually use.
Composition, vendor logic, and the ugly leftovers that do not fit a tidy label.