pages

I hunt for vulnerabilities in open and closed source software. Below is a list of some of my publicly acknowledged vulnerabilities, grouped by year. Highlights Sudo chroot and host option privilege escalation (2025) Discovered CVE-2025-32463 and CVE-2025-32462 in Sudo, which ships on nearly every Linux and Unix system. The chroot flaw lets any local user become root under the default configuration, and in September 2025 CISA added it to the Known Exploited Vulnerabilities catalog after it was exploited in attacks. The host option flaw had gone unnoticed for over 12 years. Details ...

I enjoy fixing things by breaking things. I have been using and administering UNIX/Linux systems since 1995. In early 2017, I joined a penetration test team specializing in offensive security. In 2019 I moved to the red team. In 2020 I moved into consulting conducting a wide range of penetration testing services (External, Internal, Web, Mobile, Wi-Fi, Social Engineering). In 2025, I transitioned formally into a security research role, while continuing to dedicate part of my time to offensive security assessments. ...