From the lab· losec://blog

Field notes on breaking software

Deep technical write-ups, exploit chains, and the research methods behind our disclosures. No fluff — just how the bug was found, why it mattered, and how an AI hunch became a CVE.

Research MethodologyJul 07, 2026

Cortex-Guided Fuzzing: Letting an LLM Write the Grammar

Coverage-guided fuzzers stall on structured inputs they can't guess their way into. We wired an LLM into the feedback loop to synthesize and refine grammars for the Cortex config parser — and blew past a plateau that had held for weeks.

@0xCAFE·7 min read
0-Day DisclosureJun 16, 2026

LOSEC-2026-031: Heap Overflow to Root on Meshwork MX-Series Routers

An unauthenticated request to the Meshwork MX router management daemon overflows a heap buffer during device-description parsing. With no ASLR and a predictable allocator, it is a clean pre-auth root on a MIPS target.

@heapspray9 min read
Threat ResearchMay 19, 2026

Ghostloader: Dissecting a Model-Weight Supply-Chain Implant

A loader we track as Ghostloader hides its payload in the metadata of an otherwise-valid model file and only detonates inside ML CI runners. Here is the full teardown, IOCs, and a YARA rule.

@m4lloc8 min read
ToolingApr 22, 2026

Introducing Sift: A Cross-Language Taint Query Engine

We are open-sourcing Sift, the query engine behind a lot of our findings. Write one taint rule, run it across C, Go, Python and TypeScript, and get sources-to-sinks paths instead of a wall of lint noise.

@nu11der3f6 min read
Research MethodologyMar 04, 2026

Reading 40,000 Diffs a Day: Inside Our LLM Variant-Analysis Pipeline

How we turned a firehose of open-source commits into a ranked queue of probable vulnerabilities using embeddings, an LLM security judge, and a sandbox that refuses to trust the model's optimism.

@s1nk7 min read
0-Day DisclosureFeb 11, 2026

LOSEC-2026-014: Pre-Auth RCE in Aperture EdgeProxy via Header Normalization Desync

A parsing disagreement between Aperture EdgeProxy's HTTP/1.1 front end and its HTTP/2 admin backend lets an unauthenticated attacker smuggle a template into the control plane and land remote code execution as root.

@ghostframe8 min read