Blog
Research notes, technical writing, and security posts.
The assert that kills the modem daemon: a cell broadcast crash in ModemManager
How a single legal byte in a cell broadcast message walks ModemManager into g_assert_not_reached() and aborts the root daemon, how I proved it by running all 256 data coding schemes through the real parser, and the part at the end where the maintainer sent me a patch and asked if it was correct.
modemmanager / cellular / dos / vulnerability-research / linux / cve
12 min readTwo bugs that only mattered together: hunting root in the Flatpak system helper
The story of finding a path traversal in the Flatpak system helper, chaining it with a second write primitive to reach root, a dead end that ate a day, and the twist at disclosure when one of the two bugs turned out to already be known.
flatpak / vulnerability-research / privilege-escalation / path-traversal
11 min readFour Hours, Four Bytes: Hunting Down CVE-2026-18649
The full story of finding an unbounded memory growth bug in GStreamer's RTP depayloader, including the seven attempts that failed before the exploit worked.
gstreamer / rtp / dos / vulnerability-research / cve
13 min read