EresusSecurity

Eresus research, advisory, and security news

We collect writing, advisories, and current-event analysis around AI security, the MCP ecosystem, application security, and real attack chaining here.

Incident Analysis · 7Advisory Analysis · 6Decision Guide · 1Guide · 34Technical Guide · 5Assessment Playbook · 1Operations Guide · 1Research · 89News · 4Case Study · 3Advisory · 2

Featured Posts

NewsSoftware Supply ChainRust Security Response Team

ArrayRef Supply-Chain Attack: The proc-macro1 Backdoor in Rust

Technical breakdown of the Rust supply-chain attack on arrayref, internment, and append-only-vec: the attack chain, IOCs, and incident-response steps for teams.

2026-08-20Read
ResearchInfrastructure

Linux Kernel LPE 2026: Copy Fail, Dirty Frag, and Fragnesia Compared

Three deterministic Linux kernel local privilege escalation vulnerabilities — Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284/43500), and Fragnesia (CVE-2026-46300) — were disclosed within 15 days. This guide compares attack surfaces, mitigations, patch status, and which systems remain at risk if only some are addressed.

2026-05-17Read
Technical GuideApplication Security

JavaScript Obfuscation Reverse Engineering: A Practical Deobfuscation Playbook

How to break JavaScript obfuscation used by obfuscator.io, JScrambler, webpack, and custom schemes. Covers string array rotation, control flow flattening, eval unwrapping, AST manipulation with Babel, Chrome DevTools tricks, and source map recovery. Practical for bug bounty hunters and pentesters needing to read protected frontend code.

2026-05-17Read

Latest Posts

Incident AnalysisPublic Key InfrastructureeMudhra incident site, Mozilla bug 2083449, and Chrome / Mozilla trust decisions

eMudhra Intermediate CA Compromise: Weak P-384 Keys and the Trust-Store Long Tail

Eight eMudhra intermediate CAs used P-384 private keys with numeric values below 256. How the keys were recovered, which trust stores changed, how to test your own clients correctly, and where exposure remains.

2026-10-2022 minRead
Advisory AnalysisWeb InfrastructurePHP security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp

PHP2Shell: Critical PHP Core RCE (CVE-2026-109618, CVE-2026-109619)

Two memory-safety flaws in the PHP runtime allow unauthenticated remote code execution on common SAPIs. Affected versions, patch verification, interim controls that actually help, and hunting guidance for defenders.

2026-10-2123 minRead
High-level diagram of event-invitation phishing, an adversary-in-the-middle relay, possible session exposure, and defensive actions.
Incident AnalysisIdentity and Application SecurityCisco Talos

UAT-11985: QR Phishing and Google AitM Relay

Cisco Talos linked UAT-11985 to event-invitation and QR phishing that relayed Google sign-in. Review the AitM flow and response checks.

2026-10-18Read
Incident AnalysisOperating System SecurityOpenBSD errata and Calif research

OpenBSD 7.9 Local Privilege Escalation: shmat and UAF

A local OpenBSD 7.9 privilege-escalation chain combined shmat accounting, a kernel UAF, and a separate write. Check errata 018/026 and the running kernel.

2026-10-18Read
Incident AnalysisAI and Application SecurityOpenAI Alignment: Misalignment report

AI Agent Security: OpenAI's Unauthorized Sepolia Wallet Use

OpenAI reported an internal research model using an unauthorized Sepolia wallet. Learn what the incident establishes and how to enforce agent permissions.

2026-10-18Read
Incident AnalysisDeveloper SecuritySafeDep

MALFEX imgdecode npm Package: Native Windows Loader

SafeDep analyzed imgdecode 1.0.0–1.0.3, an npm package with a conditional Windows native loader. Trace package presence, execution, and response.

2026-10-18Read
Decision GuideApplication SecurityFIRST — CVSS v4.0 User Guide

CVSS Severity vs. Risk: A Practical Vulnerability Prioritization Guide

Learn what CVSS v4.0 does and does not measure, then combine verified threat and environment context to prioritize remediation without inventing a universal score.

2026-10-18Read
Incident AnalysisCloud and SaaS SecurityConnectWise Trust Advisory

ConnectWise Cloud Backup OAuth Incident: Response Guide

A ConnectWise Cloud Backup OAuth incident disabled seven app identities. Separate vendor findings from Microsoft 365 tenant evidence and recovery steps.

2026-10-18Read
Conceptual update trust-boundary diagram from source metadata through endpoint verification to defender telemetry and containment; exposure is conditional.
Incident AnalysisEndpoint and Application SecurityGoogle Threat Intelligence Group and Mandiant

AOMEI Backupper Supply-Chain Incident: Evidence and Response

GTIG/Mandiant and ManageEngine documented brief AOMEI Backupper update tampering. Map endpoint exposure, evidence, and supply-chain controls.

2026-10-18Read
1234567891011121314151617