Research notes
Writing
Technical accounts of findings, from the first clue through the impact and the fix.
CVE-2026-86938: DLL Hijacking in the FileMaker Pro Installer
A local user could place a DLL beside the Windows FileMaker Pro installer and have it run with administrator privileges. Claris fixed the issue in FileMaker Pro 26.0.3.
CVE-2026-86924: A Bluetooth Heap Overflow in uarpd
A malformed Bluetooth accessory update made uarpd copy five times more data than it allocated. Apple fixed the heap overflow and assigned CVE-2026-86924.
Two Dots to Admin: A $50K Account Takeover on Apple
A single encoded dot-dot slipped past the authorization check and let me read any account's private data with one request, then make myself an admin with another. Here is how the bug worked.
Pre-Auth Full Read SSRF Leaking AWS Keys via Redirect Bypass
A critical pre-auth SSRF that slipped past the backend's filters with an open redirect and handed back live EC2 credentials. No login required.