Eresus research, advisory, and security news
We collect writing, advisories, and current-event analysis around AI security, the MCP ecosystem, application security, and real attack chaining here.
Latest Posts
CVE-2026-58420: Understanding Gitea Migration Restore Local File Inclusion
A practical security analysis of CVE-2026-58420 in Gitea migration restore, its operational impact, and how Eresus Guard supports evidence-first remediation.
FreeBSD TIOCSTI: Terminal Input Injection and Local Privilege Risk
A responsible disclosure summary of FreeBSD TTY input-injection research, upstream mitigation, and verification steps for system administrators.
Evidence-First Application Security: Turning Findings into Verifiable Decisions with Eresus Guard
How Eresus Guard brings DAST, SAST, SCA, IaC, and secrets assessments into an evidence-first application security workflow.
Four Chrome Extensions, One Scheme: How a Roblox Extension Network Is Farming Its Users
Version-specific static analysis of RoSearcher, BloxFinder 26.1, RoSearcher-2, and RoEarn 3.10.1: purchase-flow hijacking, data collection, forced game joins, and extension interference.
Fragnesia CVE-2026-46300: Linux Kernel XFRM ESP-in-TCP Local Privilege Escalation
Fragnesia (CVE-2026-46300) is a third Linux kernel local privilege escalation vulnerability discovered on May 14, 2026, following Dirty Frag. It exploits the XFRM ESP-in-TCP subsystem to achieve deterministic page-cache corruption and root access. Discovered by William Bowling (Zellic) and V12 security team. Includes mitigation commands and distro advisory links.
Dirty Frag CVE-2026-43284: Linux Kernel Local Privilege Escalation via ESP and RxRPC
Dirty Frag (CVE-2026-43284 / CVE-2026-43500) is a deterministic Linux kernel local privilege escalation vulnerability chain in the xfrm-ESP and RxRPC subsystems. Microsoft Defender has observed limited in-the-wild exploitation. Includes mitigation commands, affected distro list, Fragnesia variant (CVE-2026-46300), and a hardening checklist for Kubernetes nodes and CI runners.
AI Chatbot Web Application Pentesting: Attack Surface Beyond Prompt Injection
How to pentest the web application wrapping an AI chatbot — not the LLM itself. Covers IDOR in conversation endpoints, XSS via AI markdown rendering, API key exposure in frontend bundles, SSRF via browsing tools, rate-limit abuse for cost amplification, file upload attack paths, and authorization failures in share/export features.
CVE-2026-7482: Ollama GGUF Heap Out-of-Bounds Read — Full Technical Analysis
CVE-2026-7482 is a critical heap out-of-bounds read in Ollama's GGUF model loader (CVSS 9.1). Unauthenticated remote attackers can leak ~2 MB of heap memory per request — including environment variables, API keys, system prompts, and concurrent users' conversation data. Two-bug chain, full PoC, patch diff, and Ollama 0.17.1 fix.
CVE-2026-41940: Emergency Action Plan for cPanel & WHM Authentication Bypass
CVE-2026-41940 is a critical authentication bypass in cPanel & WHM affecting all versions after 11.40. Covers affected versions, patch commands, temporary firewall mitigations, session IOC checks, and a fleet action checklist for hosting teams.