Using LLMs to find bugs and vulnerabilities in software is no longer new and cool, and my 2025 post about using specialized tools to look for vulnerabilities in open-source codebases seems like a distant fever dream. The new cool thing is creating static or deterministic checks (gates, oracles, whatever you want to...

For a few years now, I’ve liked to take photos wearing funny or unexpected hats. Some people would describe them as “silly hats”, and I would agree; that is, after all, the point. My former manager Cezary – bless his soul, as just two weeks after being promoted to Director of Security a vote was held within his own...

Antiperspirant without aluminum Toothpaste without fluoride Mouthwash without antiseptic ingredients Food without salt (and don’t get me started on msg!) Food without seed oils Fat-free mayonnaise Lip balm without petroleum Hand sanitizer without alcohol Acetone-free nail-polish remover

Cleaner HTML-sanitizer bypass: mutation-XSS via MathML namespace confusion Reported as: Inside MathML foreign content, <style> is a raw-text element. jsoup therefore stores <img src=x onerror=...> as opaque text (a DataNode) and copies it verbatim, so it never sees an img element or an onerror attribute to strip....

Person A: Have you heard about Shilajit? It increases your testosterone, your lifts will go up by 20%, and it’s legal because it falls under the category of a health supplement! I’ve been taking it with my Ashwagandha and I’ve never felt better! This natural fitness trainer I follow on Instagram has been taking it...

Design, style, and ergonomics are all high up on my interests when it comes to the world. If you’ve got something that does something amazing, that’s great. But if using it makes me want to kill myself, then you’ve failed. I’ve recently been working on designing a web page which visualizes the discovery of CVEs by a...

cJSON is probably the most widely used JSON parser in the C world. It’s vendored into ESP-IDF, into a lot of embedded firmware, and into a whole lot more server-side C. I found 33 security issues in it, using a mix of AI and some manual fuzzing and review. They affect every version up to and including v1.7.19, and...

I was recently reading Max Justicz’s blog post, where he outlined how he was able to hack the unpkg.com CDN by getting the service to extract a tar file which contained: A symlink to a directory on the system, followed by a file in the symlink/directory, A hardlink pointing to a known file on the system, followed by...

I recently finally returned to Poland, after ~living in Taiwan for 7 months, where I was … bike riding, learning Chinese, and getting some experience in certain things that I never thought I’d do in my life. Upon my return, I decided that it’s finally time to admit that I’m no longer just a tourist, and make my...

This was originally written on September 15, 2020 and published on LinkedIn. I’ve decided to move the posts here for better searchability. Those that know me well, know that I am a video game history researcher, and this is just some of my random published articles. In his aptly named journal article ‘Are Video...

This was originally written on June 12, 2020 and published on LinkedIn. I’ve decided to move the posts here for better searchability. Those that know me well, know that I am a video game history researcher, and this is just some of my random published articles. Although video games have followed a history of being...

This was originally written on April 16, 2020 and published on LinkedIn. I’ve decided to move the posts here for better searchability. Those that know me well, know that I am a video game history researcher, and this is just some of my random published articles. Preface Nintendo’s domination in North America is well...