Attack chain anatomy, methodology deep dives, and security research from the team building Cipher.https://causalsecurity.com/en-ushttps://causalsecurity.com/research/busybox-security-research/https://causalsecurity.com/research/busybox-security-research/Cipher found eight vulnerabilities in BusyBox. The most serious lets an unauthenticated client crash the TLS server on the first handshake message. Others overflow the heap from a crafted filesystem image and accept a stored password hash as the password.Wed, 23 Sep 2026 00:00:00 GMTdisclosureopen-sourcememory-safetyhttps://causalsecurity.com/research/strongswan-ikev2-rekey-collision-uaf/https://causalsecurity.com/research/strongswan-ikev2-rekey-collision-uaf/strongSwan's IKEv2 rekey-collision handling caches a raw pointer to a task it does not own. An authenticated peer can make the task manager free that task, then deliver a delayed response that dereferences the dangling pointer for an indirect call.Mon, 07 Sep 2026 00:00:00 GMTdisclosureopen-sourcememory-safetyhttps://causalsecurity.com/research/openmrs-fhir2-override-authz-bypass/https://causalsecurity.com/research/openmrs-fhir2-override-authz-bypass/FHIR2 declares its read privileges as annotations on DAO interfaces. Where a concrete class overrides one of those methods, the annotation lookup lands on the override, which carries none, and the privilege check is skipped.Thu, 20 Aug 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/zephyr-6lowpan-context-unbounded-write/https://causalsecurity.com/research/zephyr-6lowpan-context-unbounded-write/Zephyr's IPv6 stack takes an 8-bit context length straight from a Router Advertisement and never bounds it to the RFC's 128. One packet from any on-link host underflows a memset length and zeroes memory far past a 16-byte buffer.Wed, 19 Aug 2026 00:00:00 GMTdisclosureopen-sourcememory-safetyhttps://causalsecurity.com/research/openemr-fee-sheet-sql-injection/https://causalsecurity.com/research/openemr-fee-sheet-sql-injection/OpenEMR's Fee Sheet inventory query uses bind parameters for its values, but the sort target, which a parameter can't fill, is built from a request field by string interpolation. A low-privileged clinical user injects there and reads the whole database, including password hashes.Tue, 18 Aug 2026 00:00:00 GMTdisclosureopen-sourcehttps://causalsecurity.com/research/eclipse-theia-file-upload-csrf/https://causalsecurity.com/research/eclipse-theia-file-upload-csrf/Eclipse Theia's browser backend enforces its connection token only on the WebSocket upgrade, leaving every HTTP route open. A page the victim merely visits can POST to /file-upload and write files anywhere the backend can reach, up to code execution on the host.Tue, 11 Aug 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/coturn-peer-acl-encoding-bypass/https://causalsecurity.com/research/coturn-peer-acl-encoding-bypass/coturn's denied-peer-ip list recognized one way of writing an IPv4 address inside an IPv6 address. Written any of the other ways, the same denied destination passed the check and the relay connected to it.Wed, 05 Aug 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/hasura-computed-field-authz-bypass/https://causalsecurity.com/research/hasura-computed-field-authz-bypass/A Hasura computed field returning SETOF a table inherits that table's row permissions on selection, relationships, and aggregations. On one path, a where-clause over the field, the filter is dropped, turning it into a boolean oracle for hidden rows.Mon, 29 Jun 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/stackgres-metrics-exporter-rce/https://causalsecurity.com/research/stackgres-metrics-exporter-rce/StackGres's bundled metrics exporter opens superuser sessions into every tenant database and runs unqualified catalog SQL with no search_path pinning, so a tenant database owner can shadow a function and reach OS command execution in the primary Postgres pod.Fri, 26 Jun 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/sevenzip-ext-oob-read/https://causalsecurity.com/research/sevenzip-ext-oob-read/7-Zip parses ext2/3/4 disk images by content. One attacker-controlled superblock field drives the inode-bitmap scan past a fixed-size buffer: a heap out-of-bounds read that crashes the process the moment an untrusted image is listed or extracted.Thu, 25 Jun 2026 00:00:00 GMTdisclosureopen-sourcememory-safetyhttps://causalsecurity.com/research/supabase-realtime-presence-leak/https://causalsecurity.com/research/supabase-realtime-presence-leak/Supabase Realtime enforces a presence.read policy on the initial presence snapshot but not on the ongoing presence_diff fan-out, so a member allowed to broadcast but denied presence can still read every other member's presence metadata on a private channel.Thu, 25 Jun 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/graphicsmagick-pcd-write-overflow/https://causalsecurity.com/research/graphicsmagick-pcd-write-overflow/GraphicsMagick ported ImageMagick's out-of-bounds read fix for the PCD decoder but not the write-side bound that shipped alongside it, leaving an attacker-controlled heap overflow in DecodeImage: the un-ported other half of the same hardening.Wed, 24 Jun 2026 00:00:00 GMTdisclosureopen-sourcememory-safetyhttps://causalsecurity.com/research/wallet-mint-open-internet/https://causalsecurity.com/research/wallet-mint-open-internet/A consumer fintech asked Cipher to extend a review into its infrastructure. Modeling the wallet's request flow end to end surfaced an internal money-crediting endpoint reachable, unauthenticated, from the open internet (proven with a reverted credit).Mon, 22 Jun 2026 00:00:00 GMTcase-studybusiness-logicpayment-flowshttps://causalsecurity.com/research/zitadel-oauth-client-binding/https://causalsecurity.com/research/zitadel-oauth-client-binding/ZITADEL's OAuth token endpoint authenticated the calling client but never checked that the grant it was redeeming had been issued to that client. The same binding check already existed on the revoke path. One missing invariant, spanning three grant types and token exchange.Wed, 17 Jun 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/vim-security-research/https://causalsecurity.com/research/vim-security-research/Seven memory-safety and code-execution flaws Cipher reported in Vim, from spell-file and soundfold crashes to command injection in netrw and arbitrary code execution in C omni-completion. All fixed upstream; one had sat in the spell code since 2006.Tue, 16 Jun 2026 00:00:00 GMTdisclosureopen-sourcememory-safetyhttps://causalsecurity.com/research/open5gs-amf-nas-oob-read/https://causalsecurity.com/research/open5gs-amf-nas-oob-read/Cipher reported a pre-authentication out-of-bounds read in Open5GS, the open-source 5G core. One malformed NAS message reaches the AMF before authentication and crashes it, taking service down for every connected subscriber.Fri, 05 Jun 2026 00:00:00 GMTdisclosurememory-safetyopen-sourcehttps://causalsecurity.com/research/payments-platform-takeover-chain/https://causalsecurity.com/research/payments-platform-takeover-chain/A field report from a cross-border payments engagement. Five findings, each a routine medium on its own, chain from an anonymous Internet request to direct money movement. The work was reading them together.Fri, 08 May 2026 00:00:00 GMTcase-studypayment-flowsbusiness-logic