How I solved Intigriti's May 2026 XSS challenge with a stored XSS in the display name, and the small payload I used to get around the SCA Shield filter.

Intigriti May 2026 XSS Challenge Writeup

How I Turned a Wrong Bug into a Free GPT Proxy Finding

How a single 10 MB gossipsub frame can force a node to allocate ~21 MB of message IDs before any cap kicks in, and the fix I sent to sigp/rust-libp2p that ended up upstream in libp2p/rust-libp2p.

A Memory Amplification Bug in Sigma Prime's rust-libp2p (used by Lighthouse)

How I chained four separate weaknesses in Intigriti's April 2026 challenge to steal the reviewer bot's cookie and capture the flag via stored XSS.

Intigriti April 2026 XSS Challenge Writeup

A practical incident response playbook for Vercel customers following the April 2026 breach. What happened, what's confirmed, and exactly what to do phase by phase.

Vercel Got Breached. Here's What You Should Do Right Now.

How I found two critical vulnerabilities in a crypto AI trading platform and everything I learned about hacking AI agents along the way.

AI Agents Think. They Just Don't Know They're Being Watched.

Hedera Hashgraph CTF Writeup

Outbound HacktheBox Writeup

DeepSeek AI in Chat Unveils the Risks of Prompt Injection to Account Takeover

Full walkthrough of Halborn's Offensive Security Engineer technical assessment VM — from initial recon to two captured flags via weak session tokens, SSTI, and a Puppeteer-powered SSRF.

Halborn Technical Assessment – Offensive Security Engineer VM Walkthrough

Verified public acknowledgments and CVE credits attributed to Adesh Nandkishor Kolte across Microsoft, Apple, Google, AT&T, HostBill, and others. Every entry links to a live source.