I’m a security researcher, penetration tester, and offensive security consultant. My work spans vulnerability research across open-source software, infrastructure, and applications — finding real security flaws and reporting them through responsible, coordinated disclosure. Published CVE advisories and technical writeups from that research are below.
One UDP Packet to Freeze an iperf3 Server: CVE-2026-102253
A single crafted parameter message and one 16-byte UDP datagram pin an iperf3 server’s receive thread at 100% CPU forever — unauthenticated, no valid test session. Fixed in iperf3 3.22.
From a Stray Apostrophe to Root: Escalating a Standard HestiaCP Account to Full Server Compromise
A single quote in a directory name lets any standard HestiaCP user account escalate to root. Reported, confirmed, and fixed in HestiaCP 1.10.5. GHSA-r9q4-pmcm-5qqf, CVSS 9.9.