Security researcher and SRE. Writing about vulnerability research, AI, and the practical stuff I figure out along the way.
A 16 actor map of a Chinese reward farming scene, built out from a single GitHub repo over a weekend. The operators know GitHub is dangerous and scrub their history religiously, but they defend the page and forget the graph: the scrub itself is a trace, and the deobfuscator they all forked is a public register of who's in the scene.
Loaded New Zealand's most visited sites in a real browser and logged every identifier handed to a third party. Two ad brokers with no consumer product turned up on a patient portal, a bank, the national lottery and a city council. Here is what that looks like on the wire, and what IPP 3A has to say about it.
Dozens of Chinese city, civic and state-media apps run their points-and-lottery campaigns on a handful of shared B2B SaaS backends. The signing that protects them uses a public salt and a key the server hands you on request. Here's the multi-tenant exposure — and why it's the more important story than any one app.
smallfawn sells JD.com login tools to other reward-farmers. By design, the buyer cannot log a victim in without calling smallfawn's own server, and the plaintext passwords are relayed there three times a day. Source-verified at file:line, with the git history that proves the server is real.
A weekend that started with a grep.app search for leaked password prefixes and ended in a 16-actor Chinese reward-farming (薅羊毛) ecosystem: its script DRM, its C2, its credential theft, and the civic apps it targets.
The current wool DRM tier is Rust with its AES key held on a C2, never in the binary. I mapped the format down to the byte and never decrypted a line. That is the design working as intended.
How a Chinese reward-farming scene seals its fraud scripts, and the old Cython DES loader I reversed end to end. The key was baked into the binary, so it protected nothing.
A full Lua sandbox escape in DragonflyDB via getmetatable(_G) metatable override, the escalations it opens up, and an unbounded-allocation DoS in dragonfly.randstr. Affected: all versions before v1.39.0. Patched: v1.39.0.
CVE-2026-6959 and CVE-2026-8052 A task container can replace the FIFO used for log streaming with a symlink to any host file. When the task restarts, logmon follows the symlink and reads or writes the target as the Nomad process user.
CVE-2026-27965 and CVE-2026-27969 - Vitess vtbackup trusted restore-time fields from the backup MANIFEST, allowing RCE via ExternalDecompressor and arbitrary path writes via FileEntries[].Name.