Vulnerability Researcher at Bishop Foxhttps://bsky.app/profile/br4inde4d.bsky.socialhttps://bsky.app/profile/br4inde4d.bsky.social/post/3myl6fftgz22nIn case you missed me at Ekoparty or No Hat, here’s a recording of my latest talk. Thanks to all those who made both of these amazing conferences possible! https://m.youtube.com/watch?v=PM0Bu7fgsM8&ra=m23 Oct 2026 21:59 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3myl6fftgz22nhttps://bsky.app/profile/br4inde4d.bsky.social/post/3mwtvq2ubmc25As promised, here's our walkthrough of CVE-2026-93616, an unauthenticated root RCE affecting Check Point Security Management and Multi-Domain Management servers! https://bishopfox.com/blog/weaponizing-check-point-management-cve-2026-9361601 Oct 2026 22:27 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mwtvq2ubmc25https://bsky.app/profile/br4inde4d.bsky.social/post/3mwjkueso4227In the meantime, here’s our analysis of an unauthenticated RCE vuln affecting SolarWinds Access Rights Manager. A hard-coded key facilitates an auth bypass that leads to arbitrary code execution as SYSTEM! https://bishopfox.com/blog/detecting-solarwinds-arm-cve-2026-2832627 Sep 2026 19:46 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mwjkueso4227https://bsky.app/profile/br4inde4d.bsky.social/post/3mwe3pn6irc2jSneak preview - we fully exploited CVE-2026-93616, an unauthenticated root RCE in Check Point Security Management Server. Blog post coming soon!25 Sep 2026 15:32 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mwe3pn6irc2jhttps://bsky.app/profile/br4inde4d.bsky.social/post/3mvhvogl6qc2zAnother excellent writeup by my colleague Nate Robb, this one analyzing an auth bypass affecting JFrog Artifactory (CVE-2026-82329)! https://bishopfox.com/blog/cve-2026-82329-unauthenticated-administrative-access-in-jfrog-artifactory-via-an-empty-cluster-join-key14 Sep 2026 10:29 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mvhvogl6qc2zhttps://bsky.app/profile/br4inde4d.bsky.social/post/3mvaef25xbs2mIn my latest blog post examining a NetScaler auth bypass CVE-2026-19490, I break down all the different ways the impact can vary depending on the the appliance configuration – ranging from DoS to full root compromise. https://bishopfox.com/blog/mind-the-config-detecting-and-weaponizing-netscaler-cve-2026-1949011 Sep 2026 10:31 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mvaef25xbs2mhttps://bsky.app/profile/br4inde4d.bsky.social/post/3mv5y5p44oc23SAML vulns are all the rage these days! Check out this excellent writeup on two bugs in Solarwinds Web Help Desk by my esteemed colleague Ronan Kervella (linkedin.com/in/rkervella). https://bishopfox.com/blog/signature-optional-analysis-of-cve-2026-2832310 Sep 2026 11:47 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mv5y5p44oc23https://bsky.app/profile/br4inde4d.bsky.social/post/3mtypuzrxak2sA simple agent authentication mistake opens up full unauthenticated RCE - check out our latest blog on two Veeam Service Provider Console vulnerabilities! https://bishopfox.com/blog/a-guid-is-not-a-credential-unauthenticated-rce-in-veeam-service-provider-console26 Aug 2026 16:10 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mtypuzrxak2shttps://bsky.app/profile/br4inde4d.bsky.social/post/3mto3p2m5uk2mWant to know if your NetScaler is vulnerable to the latest RCE chain? We’ve got you covered! https://bishopfox.com/blog/no-crash-required-verifying-the-citrix-netscaler-saml-patch-for-cve-2026-845222 Aug 2026 10:42 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mto3p2m5uk2mhttps://bsky.app/profile/br4inde4d.bsky.social/post/3mramgd6ui22wManageEngine AD360 is vulnerable to account hijacking via predictable SSO tokens. Did we exploit it? Yep. Can an attacker exploit you? Not likely. Here's why: https://bishopfox.com/blog/millisecond-of-predictability-why-cve-2026-11374-hard-to-exploit22 Jul 2026 15:14 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mramgd6ui22whttps://bsky.app/profile/br4inde4d.bsky.social/post/3mq7dapdsw22xSome adventures in LLM firmware cracking! https://bishopfox.com/blog/cracking-firmware-with-claude-senior-level-skill-junior-level-autonomy09 Jul 2026 09:32 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mq7dapdsw22xhttps://bsky.app/profile/br4inde4d.bsky.social/post/3moi2sljols2kSometimes a DoS really is just a DoS! Here's a look behind the curtain at the less glamorous side of vuln research, discussing (in mostly laypersons' terms) how we tried in vain to turn a memory corruption bug into full RCE. https://bishopfox.com/blog/a-crash-not-a-shell-solarwinds-serev-u-cve-2026-2831817 Jun 2026 10:04 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3moi2sljols2khttps://bsky.app/profile/br4inde4d.bsky.social/post/3mnmfyokjuc2bHere we GOOOOOO...! Successfully reproduced a full root unauthenticated RCE chain against UniFi OS Server 5.0.6 – with devastating impacts depending on what devices it manages. Check out our newest blog post: https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis06 Jun 2026 10:10 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mnmfyokjuc2bhttps://bsky.app/profile/br4inde4d.bsky.social/post/3mneu5fceks2pAnd another one for y’all! This week I published some research into a perfect 10 arbitrary file read affecting Ubiquiti UniFi controller software. I suspect we’ll have more to say about UniFi in the near future… https://bishopfox.com/blog/looting-unifi-controllers-detecting-and-weaponizing-cve-2026-2255703 Jun 2026 10:02 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mneu5fceks2phttps://bsky.app/profile/br4inde4d.bsky.social/post/3mmvsijbmb22kDropped some new research on the blog this week - this time we’re pulling apart a PAN-OS JWT signature bypass. Enjoy! https://bishopfox.com/blog/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass28 May 2026 10:23 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mmvsijbmb22khttps://bsky.app/profile/br4inde4d.bsky.social/post/3mhzypw6ljs2oWe successfully exploited CVE-2026-25075, a denial of service affecting strongSwan VPN servers! Be sure to patch ASAP and check out our blog for a technical analysis: https://bishopfox.com/blog/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication27 Mar 2026 11:19 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3mhzypw6ljs2ohttps://bsky.app/profile/br4inde4d.bsky.social/post/3m7a5p5yaus2bOur blog post on the Arista XSS to RCE chain is now live! We withheld exploit details because the root cause has not been fully mitigated. Patch now if you haven't already, disable your captive portal to reduce the likelihood of exploitation, and stay tuned for new vulns to be disclosed soon! https://bishopfox.com/blog/arista-nextgen-firewall-xss-to-rce-chain05 Dec 2025 09:17 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3m7a5p5yaus2bhttps://bsky.app/profile/br4inde4d.bsky.social/post/3m75votckms2kMy team confirmed that recently disclosed Arista NGFW vulnerabilities are fully exploitable! RCE is possible with victim interaction. More details coming soon to our blog: bishopfox.com/blog04 Dec 2025 11:48 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3m75votckms2khttps://bsky.app/profile/br4inde4d.bsky.social/post/3lwjthvnywc2xJust published a new blog about using LLMs to accelerate patch diffing! We developed a semi-automated analysis workflow and benchmarked four high-impact vulns using a few different Claude models. Check out how they performed! https://bishopfox.com/blog/vulnerability-discovery-with-llm-powered-patch-diffing16 Aug 2025 16:54 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3lwjthvnywc2xhttps://bsky.app/profile/br4inde4d.bsky.social/post/3lnm4gaffv22cI made SonicWall’s hall of fame for this one. Patch your firewalls (again), folks! https://bishopfox.com/blog/sonicwall-sonicos-versions-7-1-x-and-8-0-x25 Apr 2025 01:53 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3lnm4gaffv22chttps://bsky.app/profile/br4inde4d.bsky.social/post/3lkqgua2fvk2lThe DistrictCon talk @noperator.bsky.social and I gave on decrypting SonicWall NSv firmware is up on YouTube now: https://www.youtube.com/watch?v=FIYKlv48f6Y19 Mar 2025 14:54 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3lkqgua2fvk2lhttps://bsky.app/profile/br4inde4d.bsky.social/post/3lhwucetbu22qThey got me on camera to talk about my recent SonicWall exploit 😄 https://youtube.com/shorts/9HwZB_9-okQ?si=8HJIGH9EbTlDqGqr11 Feb 2025 23:55 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3lhwucetbu22qhttps://bsky.app/profile/br4inde4d.bsky.social/post/3lhty27ofqk2qAs promised, our blog post on CVE-2024-53704, a session hijacking vulnerability affecting the SSL VPN component of SonicWall firewalls, has been updated to include full exploitation details. Check it out! https://bishopfox.com/blog/sonicwall-cve-2024-53704-ssl-vpn-session-hijacking10 Feb 2025 20:24 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3lhty27ofqk2qhttps://bsky.app/profile/br4inde4d.bsky.social/post/3lfxflscp6k2uSuccessfully exploited SonicWall CVE-2024-53704, allowing active SSL VPN sessions to be hijacked on affected firewalls. We'll be withholding details for a while because there are still thousands of vulnerable appliances on the public internet.17 Jan 2025 18:14 +0000at://did:plc:3hicryvxip2c2z4eb7wtpyvm/app.bsky.feed.post/3lfxflscp6k2u