north echo

Independent security research and coordinated disclosure.

“It is a profound and necessary truth that the deep things in science are not found because they are useful; they are found because it was possible to find them.”
J. Robert Oppenheimer

Latest

all posts → all disclosures →
  1. cve
    bootc/ostree: Staged Deployments Not Revalidated Against Container Signature Policy Before Finalization
    CVE-2026-16460 · unpatched
  2. cve
    Leapp RHEL 9→10 Upgrade: scan_mysql Runs mysqld as Root and Can Load mysql-Writable Plugins
    CVE-2026-75092 · unpatched
  3. cve
    A2A Java SDK: Android Synchronous POST Overrides Redirect Fix and Forwards Credentials Across Authorities
    CVE-2026-111765 · fixed
  4. cve
    OpenShift Pipelines-as-Code: Repository Creators Run PipelineRuns as the Auto-Provisioned Pipeline ServiceAccount
    CVE-2026-50240 · unpatched
  5. cve
    Ignition: Low-Privilege Project Creation Leads to Gateway-Side Script Execution
    CVE-2026-77393 · fixed
  6. post
    Keeping Your Substation More Secure
  7. post
    Two OpENer Findings, and a Coordinated Disclosure That Almost Worked
  8. post
    The Linux kernel wanted to be a CNA. They got their wish. Then AI came along.
  9. post
    Why I Trust Codex More Than Claude Code for Vulnerability Research
  10. post
    What I Learned Auditing 9 AI Agent Frameworks

Tools

Fluxgate

Static analyzer for GitHub Actions workflows. Detects pwn requests, script injection, and supply chain risks.

WAINGRO

AI agent skill security scanner. Static analysis tool that detects malicious patterns in OpenClaw/Agent Skills format skill files.