From the lab· losec://blog

Field notes on breaking software

Deep technical write-ups, exploit chains, and the research methods behind our disclosures. No fluff — just how the bug was found, why it mattered, and how an AI hunch became a CVE.

AI SecurityJul 17, 2026

No Keys Required: Inside the Attack Surface of xLLM

xLLM is a cutting-edge language model with a unique attack surface. This post explores the potential vulnerabilities and security considerations when interacting with xLLM.

@hypnguyen1209·10 min read
The Night I Decided to Kill Frida
Mobile Reverse EngineeringJul 17, 2026

The Night I Decided to Kill Frida

Frida is a dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. This post chronicles the night I decided to stop using Frida and the reasons behind it.

@hibana3 min read
The Final Days of Huntr OSS: One Night, Three Reports, and $1,625 in Bounties
Bug BountyJul 16, 2026

The Final Days of Huntr OSS: One Night, Three Reports, and $1,625 in Bounties

Before Huntr shut down its traditional open-source bug bounty program and shifted toward Huntr 2.0, I returned to the platform one last time, discovered three vulnerabilities in NLTK in less than twelve hours alongside GPT-5.5 Ultra, and ultimately received $1,625 in bounties.

@khanhdlq5 min read