pspaul's blog

Escape from AppleScript: Even folder names can be user input

Jellyfin remote code execution: Inconsistent validation leads to argument injection

OffensiveCon 2026: SELECT shell FROM postgres: Digging up a 20-year-old bug for ZeroDay.Cloud

For the first edition of ZeroDay Cloud, the new kid around the hacking competitions, we had a look at multiple targets. PostgreSQL, one of the most-used database systems, was an interesting one: Plain C code base, with some parts being over 20 years old. We found an interesting bug, but it was not straight-forward to exploit and led us down a rabbit hole of UTF-8 mishandling and forced us to learn…

CVE-2026-2006: Encoding bug in PostgreSQL pgcrypto leads to Remote Code Execution

Argument injection in YTDLnis via Android intent

Insomni'hack 2026: Zombie Workflows And Other GitHub Actions Horror Stories

ZeroDay Cloud 2025: Post-Auth RCE in PostgreSQL

Zombie Workflows: A GitHub Actions Horror Story

Ollama Remote Code Execution: Securing the Code That Runs LLMs

Hack.lu 2025: Lethal Language Models: From Bit Flip To RCE In Ollama

Code Security for Conversational AI: Uncovering a Zip Slip in EDDI

Securing Kotlin Apps With SonarQube: Real-World Examples

TROOPERS25: Scriptless Attacks: Why CSS is My Favorite Programming Language

Double Dash, Double Trouble: A Subtle SQL Injection Flaw

Data in Danger: Detecting Cross-Site Scripting in Grafana

Beware the Cookie Monster: Cyberhaven Extension Vulnerability Allowed Cookie Theft

GymTok: Breaking TLS Using the Alt-Svc Header

Ever wondered what the Alt-Svc response header is used for? Turns out it can be used to become a Man-in-the-Middle and attack TLS!

Ancient Monkey: Pwning a 17-Year-Old Version of SpiderMonkey

Last year, @swapgs and I found a fun bug in the popular enterprise VPN solution Zscaler. The VPN client used the pacparser library to decide which HTTP requests to proxied based on a PAC file.

Hack.lu 2024: SQL Injection Isn't Dead: Smuggling Queries At The Protocol Level

SQL injections seem to be a solved problem; databases have built-in support for prepared statements, leaving no room for injections. In this session, we will go a level deeper: instead of attacking the query syntax, we will explore smuggling attacks against database wire protocols, through which remote, unauthenticated attackers can inject entire (No)SQL statements into an application's database…