Vulnerability Research

I hunt for vulnerabilities in open and closed source software. Below is a list of some of my publicly acknowledged vulnerabilities, grouped by year.

Highlights

Sudo chroot and host option privilege escalation (2025)

Discovered CVE-2025-32463 and CVE-2025-32462 in Sudo, which ships on nearly every Linux and Unix system. The chroot flaw lets any local user become root under the default configuration, and in September 2025 CISA added it to the Known Exploited Vulnerabilities catalog after it was exploited in attacks. The host option flaw had gone unnoticed for over 12 years. Details

OPENSSLDIR: a Windows privilege escalation bug class (2019 to present)

While researching the Private Internet Access VPN client in 2019, I found that Windows applications bundling OpenSSL often read their configuration from a path any local user can create, so a malicious OpenSSL engine runs with the application’s privileges, often SYSTEM. The research led to a fix in OpenSSL itself (CVE-2019-1552) and in curl, MongoDB, stunnel, Aviatrix, and Microsoft Defender for Endpoint, with many more reported privately. Since that research, other researchers have used the same technique to find 34 more vulnerabilities, 33 with CVEs, as recently as 2026, in products including McAfee Agent, FortiClient, Splunk Enterprise, MySQL, Node.js, Veritas, Acronis, Symantec DLP, and Metasploit Pro. I track them, along with a detection tool, in openssldir_check.

Breaking vendor fixes

Found a bypass of F5’s original mitigation for the critical BIG-IP CVE-2020-5902 with Chase Dardaman, showed VMware’s first patch for CVE-2020-3950 did not fix the bug, and wrote an exploit for a sudoedit regression the Sudo project fixed without an advisory.

Appliance research

Unauthenticated remote code execution and undocumented backdoors in MoFi LTE routers (10 CVEs), unauthenticated remote code execution as root in Kaseya Unitrends backup appliances (12 CVEs), and 10 CVEs in the Aviatrix Cloud Controller, four rated critical by Aviatrix, including pre-authentication remote code execution, pre-authentication account takeover, and cross-site request forgery.

All vulnerabilities