MonkeHacks #99

We’re nearly at MonkeHacks 100! I’ve been a bit quiet in the last month or so, but I’ve had a lot going on (and a lot to talk about) so I thank you for your understanding.

I spent two weeks in Ukraine to meet my girlfriend’s family, in Kyiv. Spending two weeks there, amidst the conflict, made a deep impression on me.

I’ve been building a hackbot, because I realised that I need to build something that finds me leads while I work on the startup idea.

I organised and hosted an unofficial Google bug hunters meetup in Dublin, in lieu of a cancelled Bugswat event. It went smoothly and we had some great talks (special thanks to Workday, the Irish Government and Critical Thinking Podcast for assisting with the venue and swag and such, and special thanks to Brutecat for speaking with us about his work on Google in a lot of depth).

I returned to Cork for about 10 days after that, and now I’m back home in Edinburgh.

Weekly Ideas / Notes 

Terraform and Google Workspace

I’ve been working on a number of interesting problems. One of them was that I needed a demo Google Workspace tenant with realistic data to test some ideas. To do this, I used Terraform and a GCP service account to declaratively set up the workspace, meaning that I can recreate it or manage most of its state relatively trivially. Terraform is really the ultimate way to manage the state of almost anything declaratively. I’m still looking for other ways to apply it for non-cloud resources.

Hermes

I tried using Hermes agent, and the core CLI is fine - but the Desktop application sucks. A “profile” is a kind of workspace or group of resources in Hermes. I thought the CLI was the source of truth, but no! When I tried to delete a profile in the Desktop app, it kept reviving itself, even after I used the CLI to delete it. It was apparent to me then that there was another bit of code somewhere that didn’t actually get rid of the profile from its memory, and so I decided that I had had enough of dealing with this and went off to write my own version instead. I had my own version running on a Raspberry Pi before, but I used Fable 5 with Claude Code’s Ultracode setting to write an even better version.

Exploiting my own brain

I spent far too much time playing Clash Royale recently (I pushed to 11,700 trophies, but at what cost..?) so I’ve decided that enough is enough. One thing I’ve been putting off - or been generally bad at - is holding myself accountable to savings goals. So in parallel with the hackbot development (by in parallel, I mean in another Claude Code window at the same time), I’ve been developing a mobile game purely for my own use, that gamifies the saving / habit-making process of good financial management. I aim to use the classic dopamine-abusing game mechanics to point my brain in the right direction.

This is dummy data, of course, but this is what it roughly looks like. The village gets dirtier and less aesthetic if I ignore the tasks, and reaching savings goals has various in-game mechanics. The town evolves with more net worth.

Hackbot

I am now on the second iteration of my hackbot. This has been quite challenging and I’ve learned a lot. The first iteration was purely unauthenticated and subsequently found very little. I did incorporate a number of good ideas into it, largely inspired from the CTBB episode about hackbots that the lovely folks at CTBB did. My newer iteration focuses more on Human In The Loop. I think I tried to jump too far into something fully automated, when the ideal sweet spot is a mix of manual hacking and AI automation.

I’m never short on good ideas, so I trust that this project will pay off very soon. I’m using Codex as my core model for hacking, but writing everything in Claude Code’s Max 20x plan. I have smaller analysis agents that use Deepseek’s fast model for cheap token cost.

Dublin Hacker Meetup

We held a hacker meetup in Dublin in lieu of the cancelled Google Cloud Bugswat. It was a two-day meetup with talks, drinks and hacking together. Special thank you to Workday for providing the venue, Critical Thinking Podcast for providing swag (you guys rock) and Brutecat for answering our many questions in a Q&A!

The gang on Day 2. We had a few more people on Day 1.

Iceland

A certain large company is hosting an educational event in Reykjavik in Iceland, so I’ll be there from 13 July to 17 July. If you know, you know. I’ll see you there if you’re going! More on that in MonkeHacks 100.

Reflections on Ukraine

On a more serious note, I was in Kyiv for two weeks, from June 5 to June 19. I travelled there via Przemyśl in Poland, and took the train for 9 hours overnight with my girlfriend, who is from Kyiv.

In the first few days we experienced a few drone attacks, but I didn’t hear the drones themselves, only the sirens. The sirens sounded like the World War II air raid sirens - rising and falling in pitch. It was always, always a bit spooky.

I was quite lucky in my first week, and there were very few attacks at all - just a few sporadic drones overnight on most nights to keep the Kyiv population awake. I made several trips into the city centre, and saw many cool things - I visited the Independence Square and paid my respects to the fallen soldiers, I bought some war-related memorabilia to help fund the frontline efforts and to bring something back for my friends back at home, and I visited the Lavra (a large, beautiful monastic complex).

However, this changed drastically on June 15. Russia launched a massive attack on Kyiv. Across Ukraine, they launched over 70 missiles and 600 drones, including 6 hypersonic missiles, 34 ballistic missiles, and 30 cruise missiles. I sheltered in the basement of my partner’s family’s house, and we heard the ballistics fly over our heads. They sound like jet engines, and they always sound closer than they really are. It’s terrifying.

Moments later we heard a series of explosions, as well as the pum-pum-pum of the air defence kicking in and shooting down the drones. They sound like they’re right above your head, even if they’re a few miles away.

Ballistics are fast. Once they fire, you have about five to ten minutes to find shelter before they reach Kyiv.

Unfortunately, that night they struck the Lavra cathedral and monastic complex that I had visited a few days previously, and the cathedral roof caught fire. Two days later, I visited a famous market area with my partner, but unbeknownst to us, it had been struck by missiles on June 15.

The pictures below are of this market, still smelling of ash and smoke from two days previously.

Pochaina Market, Kyiv. This building appeared to have been struck directly, because concrete floors were caved in. The fire spread to nearby stalls and burned down the stalls for about 200m to the right of this building.

While the war always seemed quite distant to me, it became very, very real once I saw it myself. This war is on our doorstep in Europe. 9 hours on the train from Poland is almost nothing! I have decided to step up my participation in Irish national security measures as a direct result of this experience.

You, as the reader, will probably read this and go on with your day. But take a minute, or even 30 seconds, to think about this more critically for a second. Be glad that you don’t have to smell the ash from people’s businesses burning down, or hear the haunting roar of missiles over your head, or the booms of air defence. This is what the Ukrainians live with on a near-daily basis. They are immensely strong people and we can learn a lot from that. Most of all, do not think that this era of peace will last forever. Looking at history, we’re just in a lucky streak of peace right now. War is closer to your life than you think. Just keep that in your thoughts today, that’s all I ask.

Resources

• NPX Confusion: A new supply-chain technique developed by Roni over at Depi. It’s a variation of dependency confusion.

• Measuring LLMs’ impact on N-day exploits: Anthropic notes the effect that LLMs have on producing exploits for N-day vulnerabilities, which have been historically slow to develop.

• Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js: Zhero is back with another whopper of a finding in Next.js.

• masso: Tool for testing SSO implementations.

• One trigram at a time: XSLeak via Universal CSS Injection and DoS in Opera (GX): More phenomenal research from Zhero.

• Github Actions TOCTOU: Another Github Actions bug class by Lupin. Depi continues to dominate this area at a technical level.

• Backstage access: an unauthenticated SQL injection in Front Gate Tickets: More of that super-impactful critical research from Ian Carroll and co. This time, attacking the ticketing platform powering most large festivals.

• Squidbleed (CVE-2026-47729): A very nice memory bug in Squid proxy.

MonkeHacks #98

It’s been a few weeks - as usual I have a number of updates. I’m currently in Kraków in Poland, and I’ll be taking the train to Kyiv in Ukraine this evening. I’ll be in Ukraine for the next 2 weeks as I visit my partner’s family.

This is likely going to be a challenging yet novel experience for me, and I’m uncertain what to make of it, but it’s my choice - and going into an active warzone is always a risk, but it’s a risk I’m personally accepting and the consequences of it lie with me. I’m under no illusions about what I’m going to experience - Kyiv was and is under active bombardment by drones, missiles and hypersonic/ballistic missiles as well.

Unrelated to that, I am organising an unofficial LHE in Dublin on June 23 and 24, presuming I leave Ukraine unscathed. Google were supposed to have their flagship GCP event on those days, but for unknown reasons, they cancelled it, so those of us who were going to go have decided to organise our own unofficial LHE. It will be held in Workday’s offices in Dublin. If you are interested in attending, please reach out to me directly.

I’m still working on my startup every day - there’s always more to do. It’s endless and it’s frustrating me that I can’t move faster on it.

Eider ducks with their ducklings by the ocean in Leith, Edinburgh.

Weekly Ideas / Notes 

• I spoke at Bugcrowd’s Hacker Roadshow in Edinburgh. It’s nice to speak with people on the other side of the bug bounty fence.

• I booked my tickets for Def Con 34 in August! I’ll be hanging around Bug Bounty Village again.

• Mostly, though, I’ve been working on my startup, Starstrike. I’m on the fourth or fifth iteration now - I keep finding problems with one thing, then slightly changing the angle of it to align with what people need a bit better, and then I repeat that process. I have a few design partners who are incredibly helpful.

• The problem with startups is that I’M NOT MOVING FAST ENOUGH. I WANT TO MOVE FASTER. The urgency I feel to get it working and productised is insane. I do feel that I’ve finally found something only I can do, so I’m pretty happy, but the process is brutal.

• So much of the startup process is also completely counterintuitive. I’ve spoken with a number of active founders and people who’ve sold their companies already, and generally I always learn a thing or two that goes completely against my assumptions. It’s been a wild journey so far and I’m really, really enjoying it.

• On June 23 and 24, there will be an unofficial bug bounty meetup in Dublin. Let me know if you’re committed to attending - it is in-person only!

Resources

• Pwning Minecraft: 4-Byte Heap Overflow to RCE: This is SUCH a good article. Very in depth, and beautiful hacking.

• Negative-Days with Vulnerability Spoiler Alert: Three Months Later: Spaceraccoon’s “negative-day” experiment, three months later. It’s shown to be working well.

• To Kara, Alex, and Michiel — Your Researchers Are Leaving: Patrik’s critique of HackerOne, which, quite frankly, I agree with.

• Poisoning Claude Code: One GitHub Issue to Break the Supply Chain: Ryotak hacked Anthropic again.

• From a Misconfigured Grafana to 507 Private Meta Repos: A Bug Worth $157K: A mega-bug on Meta!

MonkeHacks #97

My focus recently has been on the startup, which I am taking fully seriously now. It’s full steam ahead and I’m iterating rapidly on it with both Claude Code running Opus 4.7, and Codex running GPT 5.5, and I’m fixing the issues that one causes with the other, which has proven to be quite effective.

I was back in Ireland for a week; from last Monday to Friday. It was about 4 months since I’d last spent time with my friends and family back in Cork, and so it was important for me to strike that balance between work and life, and dedicate some time to them.

This is the view near my office on a sunny day.

Weekly Ideas / Notes 

• I did a Hackalong over at Critical Thinking. The target was Superhuman (formerly Grammarly) and I found one bug on-stream - a classic AI data exfiltration. Rest assured the complete chain is not in the recording - I finished the chain and reported it with Valentino after the stream. It felt good to hack something again, as recently I’ve been spending all of my time on building my startup platform.

• On that topic, I’m making great progress with the startup MVP, which is almost at a V1 now. Building enterprise-ready systems is challenging and the scope of what needs to be done is quite broad. I went to a founders’ meetup locally and I gained some great insights into what it’s like to run a company - there was a multi-time founder there answering fireside questions, so I really found that valuable. For my development cycle, I’ve been bouncing between using Opus and Claude Code on both CLI and the mobile app to plan new features, and implement them, and I’ve been using GPT5.5 on Codex to smooth out the entire system - all AIs have their shortcomings.

• I am, generally, non-confrontational, which has numerous downsides. I was examining my credit card point stacking system, and it occurred to me that I should probably ask if there are any offers for loyalty or renewal - lo and behold, there were! So they offered me a nice chunk of points just for staying with them. Sometimes just asking goes a long way.

• Following along this type of system, I’m trying to write some harnesses for each part of my life to optimise it as a whole. There’s probably a lot of optimising that I could do, but as rez0 put it, I have a limited number of human tokens and I don’t think I could keep track of everything. So I had the thought to harness things and have an LLM find the stuff that I can optimise a bit better. This could be as simple as using a credit card with a slightly better cashback scheme that would add up in the long run. These incremental gains across many different optimisations could result in a 20%-30% gain or more across the board, so that was and is my goal with this idea. I want these subsidised tokens to pay attention to the stuff where I’d learn absolutely nothing if I did it myself.

• And finally, following along from that train of thought, it’s important to distinguish between the benefits of AI that are just marketing posture and a fear of getting outdone by a competitor, versus a real tangible benefit that could survive on local models in a worst-case scenario. Because most of the stuff out there is just acting on fear-mongering. It’s easy to get caught up in the hype.

Resources

• From Tomcat JMX Proxy to RCE via AccessLogValve Injection: Superbly high-quality research from Hacktus on Apache Tomcat exploitation.

• HTTP desync in Discord's media proxy: Spying on a whole platform (2022): Desync in Discord. Yeah. That’s pretty horrifying.

• $15k - CSPT to full account takeover, then 2FA bypass via the prototype chain: A really awesome 2FA bypass. I can appreciate a good server-side Javascript bug.

• HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555): This is extremely high-quality research. Definitely one of those Portswigger Top 10 candidates for next year.

• Leaking YouTube Creators Private Videos: This was apparently marked as a non-issue by Google. That surprised me because it seems perfectly valid to me.

MonkeHacks #96

I meant to post more regular updates, but writing this by hand takes time, and I’ve been very busy, so here we are. What a month! Between hacking for Google’s Live Hacking Event in Seoul, and helping STÖK to vlog the Google event (we couldn’t film on-site, but we could film the city) and re-organising things and dwelling on the startup, there’s been a lot going on. I feel my purpose becoming clearer, and the way forward is revealing itself to me slowly.

Team “Save Our Seouls”!

Weekly Ideas / Notes 

• I visited Seoul in South Korea to take part in Google’s AI Bugswat LHE. I spent the entire event on a team with STÖK and Busfactor. We came 2nd overall, which was much better than we expected to do, and we also got Most Creative (STÖK’s bug) and Most Novel Prompt Injection (my bug). This is busfactor and I’s second consecutive 2nd place (first was Mexico in October), and we beat some hackers that I never thought we’d beat in a million years, so I’m surprised and really happy by how it went. We’ll be writing up some of our bugs.

The trophy is absolutely beautiful.

• Next up for Busfactor and I is another Google event in June, in Dublin! It’s weird to me to see a LHE come to home turf (Ireland), but it’s also very exciting for me. I’ve been planning out what I need to do in preparation for that event. The scope will probably be a lot more technical, so I have a lot of work to do beforehand.

• I’ve been watching Karpathy’s Zero to Hero playlist for neural networks, and it’s been really interesting. Understanding how it works mathematically is satisfying. I’m trying to fill in the blanks in my knowledge of ML and LLMs, and it all starts from the basic building blocks. Somehow I’ve been enjoying the calculus as well. I tried to study neural nets when I was a teenager, but only now do I have the knowledge and skillset to truly appreciate them and study them properly.

• I’ve been implementing his LLM wiki blueprint using Claude. I don’t use AI nearly enough day-to-day. I’m focusing more on self-augmentation now than replacing what I do. I refuse to turn myself into a copy and paste monkey that just transfers AI-completed work between various LLMs. So far, it’s been very impressive - the wiki is an Obsidian repository residing on my password-protected portable SSD, and I have a simple Go-based CLI utility for updating it and linting the contents.

• I’m putting my entirely separate bug bounty wiki (with the same codebase for interacting with it - a CLI and Claude Code commands) on Obsidian Sync so I can access it from anywhere. Opus 4.6/4.7 is very good at managing the wiki linting and such. Yes, I could implement something like Obsidian Sync myself, but they make it so easy to sync everything, so I just paid up for the sheer convenience.

My wiki system looks approximately like this.

• I’ve gotten a fixed desk in Edinburgh’s main tech startup hub. I moved one of my monitors into it. I’m hoping to move to a new apartment a bit closer to the office soon. My current place is alright, but it’s too expensive and it’s quite far from the city centre. I’m really enjoying having my own office, it forces me to be productive. The next step for my startup is to talk to as many people as I can.

Resources

• How I Got Into Starbucks' Internal Network using a non resolvable hostname: A bizarre behaviour with absolute URIs led to SSRF in Starbucks.

• The Agentic Hacking Era: Ramblings and a Tool: rez0’s notes on agents.

• Zero Days, Zero Truths: Brutelogic’s article on the validity of the Mythos model’s cybersecurity capabilities. It’s very well written and well sourced. A fantastic read - we don’t see articles of this quality too often.

MonkeHacks #95

This post is very late; I’ve been on holidays in Japan for most of the month with my best friend. We flew with KLM to Osaka, hung out there for a while, and then travelled to Hakone, then Tokyo, then Sendai to visit my grandmother, and now I’m back in Tokyo on the way back through Japan. I fly back home in 5-6 days. I haven’t been hacking at all in the last few weeks. Google’s next LHE is happening in early April; there’ll be plenty of hacking to do very soon. For now, I save my energy and rest.

I tried a few new things this time - we went to a batting centre for baseball, and I really enjoy that - there’s something tranquil about a place where all you have to do is hit a ball. It’s just you and the ball and the bat. I fully understand why people go there to de-stress after work. I also used the onsen (hot springs) in Hakone, which have been really amazing. In Tokyo, I went bouldering with Kodai and mokusou, my two longtime hacker friends (they’re Rhynorater’s former mentees). I got new shoes here in Tokyo, and the cherry blossoms have started to bloom.

Soon, I think I'll reformat this newsletter a bit. I might keep this weekly format as a blog of what I do outside of hacking (or I might switch to biweekly for that stuff), and write the ideas I come up with as full blog posts instead.

Hakone Mototsumiya Shrine in Hakone. It was snowing and it was almost silent up there, very tranquil.

Weekly Ideas / Notes 

• There’s been some discourse on hacking with AI lately, so I’ll throw my own 2c into the mix. Yes, you will fall behind if you don’t adopt AI for hacking as soon as possible. No, this will not kill bug bounty, and various complex sub-disciplines of hacking will be safe because they’re too specialised. Yes, organisations that don’t accommodate for the increase in valid submissions / findings as a result of AI will be in trouble. Those are my thoughts. Opus 4.6 is much better than people think. The frontier models like 4.6 are way further ahead than most people realise, even those who dabble with AI occasionally.

• Adding on to this, bug bounty is going to look very different in the next one to two years. It will be more lucrative than ever if you’re established in the space and know how to find bugs. If you’re a beginner or you’re trying to establish a foothold, it’ll be harder than ever to break into bug bounty. The bar of “low hanging fruit” will rise to “medium hanging fruit”. The one thing that doesn’t change is that if you’re a motivated individual who can think critically, you’ll be fine.

• I have greater concerns about the core bug bounty platforms as a whole. Both HackerOne and Bugcrowd have new leadership and some notable figures involved with the community on both sides have left in the last few years. Both platforms are pushing their pentesting offerings more heavily, as they are obviously more profitable. Will their boards prioritise profits over supporting the researcher community?

• There’s probably room to undercut these platforms by creating a ticketing and payments system, but allowing programs to hire their own triagers or use managed triage services from other sources more easily. Since bug bounty is quite expensive to run on the existing platforms, I could see companies moving to this hypothetical new platform quite quickly if they can find triagers. I’m not going to build this thing, and these are just my thoughts on the matter. But maybe this will give one of you readers some ideas. One thing is for sure, the nature of bug bounty is changing, and the platforms are adapting. If you don’t adapt too, you’ll get left behind.

• I connected my Claude Code (running on a VPS) to a Discord bot I vibecoded, so now I use Discord to manage projects. It needs work, but it’s cool. It’s a start.

• We’ll be publishing another Starstrike blog soon - the only blocker is just that I’m really busy with travel right now. But soon! Soon. And after that, we have a really really cool blog post coming.

Reading List

Resources

• Can a Predicted window.open Target Really Be That Impactful?: Yes, it can.

• vinext: Vibe-Hacking Cloudflare's Vibe-Coded Next.js Replacement: Nice article on Cloudflare’s slopware having bugs in it.

• Turning Almost Nothing into a Supply Chain Compromise of Angular with GitHub Actions Cache Poisoning: Adnan Khan, Github Actions hacking extraordinaire, compromised Angular’s main repository.

• Hijacking the Channel: Zero-Click Account Takeover via MessagePort Injection: Really cool client-side bug on MessagePorts, which are often overlooked, and quite common in Chrome extensions.

• Persistent XSS/RCE using WebSockets in Storybook’s dev server: Some very clever attacks here. Stuff I haven’t really thought about before.

MonkeHacks #94

Finally, I’ve returned to Scotland - 14.5 hours from Tokyo to Paris, and then 2 hours to Edinburgh. I had a fantastic (albeit exhausting) trip. The LHE venue was out in Chiba near Tokyo Disneyland, which was isolated from the rest of Tokyo so there wasn’t actually a whole pile of stuff to do there if you don’t care about Disney. The event itself was fantastic. I caught up with some hacker bros, made some new friends, and had a great time.

I’m back in Scotland for about 10 days before I fly off to Japan again, this time with my best friend from Ireland, for 3 weeks. My cats are also going on holidays; to a luxury cat hotel in Edinburgh. I hope they’ll be comfortable there while I’m away.

36 Monke Views of Mt. Fuji. But seriously, this was a photo I took from Haneda airport the day before I left Japan. You need a windy day to blow the haze away to see the volcano.

Weekly Ideas / Notes 

• The LHE went well - I had a few good findings with my team, so I’m satisfied with how it went overall. The onsite days were intense; we’d wake up, have breakfast in the hotel cafeteria, then settle in for a day of hacking in the ballroom that was the main venue on both days. The coffee they served was weaker than usual, so we went back to the machine for multiple helpings throughout the day. That was nice, too, in that it provided some breaks to walk around a bit and think about the scope. The scope was great, really enjoyable and had quite a bit of depth to it.

  • It’s hard to describe what being in a LHE is actually like. I’m a bit desensitised to it (this was LHE number… 11 for me? I think?) but it’s no less fun every time. Sometimes bug bounty comes across as a bit of a soulless endeavour, but at LHEs, you meet the staff and the program managers and such that are behind the scenes, and they add a level of depth to everything that’s hard to describe. The stakes are different for both you and them when you submit a bug. The staff (usually) do appreciate elegant bugs. Which, considering the spam they usually receive, I can hardly blame them for.

• I got tickets for Bsides Dublin (which is happening in May). Last year I gave a workshop there; this year I didn’t feel like giving a talk, so I’m going as a simple attendee. I know the folks at Bsides Dublin by now, so it’s a nice annual ritual of mine to go and chat with them.

• These days I’ve been thinking more about bug bounty, and which parts of it actually have an impact on a company’s security posture. The reality is that it’s highs and crits. Things that can affect the company’s stock price, or customers. Being more involved on the business side has forced me to think more businesslike about other things too, including bug bounty.

• I published VolumeLeak on the Starstrike blog. It’s a really interesting vulnerability that I found with Busfactor, where I created a classifier system to exfiltrate data out of a limited set of circumstances. I think we’ll see more usage of classifier systems in data exfiltration in the future. There are often tool calls with limited write capabilities, after all.

• I’m optimistic about AI security in general. I really do think that guardrails will be a good enough deterrent to prevent prompt injections, if they’re developed in the right way.

Reading List

Resources

• VolumeLeak: Classifier-based Data Exfiltration via Volume Settings: Another self shoutout. This one is also interesting, I promise.

• Almost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services: This research is SERIOUSLY impressive. Just… wow. Not the type of bug that you can oneshot with AI.

MonkeHacks #93

I’m writing this from Tokyo at the moment. I thoroughly enjoyed my flight over here with JAL. Fortunately, Manchester United were playing during the first two hours of the trip, so I was able to use the in-flight WiFi to tune in on the internet radio. We live in blessed times.

Speaking of blessed times, I really missed the food here. It’s great to be back. I wouldn’t live here, because I have cats and my life built up back in Scotland, but it’s very nice to spend a month or so in total here in Japan each year through LHEs and holidays. I nurture my Japanese language skills and so rather than deteriorating, my Japanese improves in its fluency year-on-year.

For now, the focus returns to the LHE. I’m not going to win or anything, but I want to do my best and give it a good shot.

Tokyo Skytree. Taken with the Fujifilm XE5 with a film simulation recipe.

Weekly Ideas / Notes 

• I read Siddhartha by Herman Hesse this week. I highly recommend this book as it offers some insight at whatever age you are. Some people view this book as a kind of blueprint or guide for living, but I disagree with those people; it’s a book about the life of a person, nothing more, nothing less. You can certainly derive insights from that person’s life, but you miss the entire point of the book if you use it like a guide.

• I also read The Stranger (published as The Outsider outside of America) by Albert Camus. This was also a relatively short book, about a murder on a beach, and the price of being different (albeit told through a morbid lens). I recommend this book also.

• I did a lot of hacking this week because the LHE kicked off. It’s been going reasonably well; I’m collaborating with Busfactor again, as well as two more friends from the CTF scene. We’re doing some good work, but it’s unlikely that I’ll be able to talk about this any further as the customer is quite secretive.

• There was some drama this week in the community about whether or not platforms were training AI hackbots using researcher reports. HackerOne’s leadership provided clarification that they were not using researcher reports, and while I’d like to believe it, I struggle to see what data HackerOne would have that isn’t researcher data. Why would they compete in the space without any competitive edge? What data could there be that would make the product worthwhile at all? It just doesn’t add up. It’s not all bug bounty platforms, either. Just the ones that have crowdsourced pentest products that make up a significant portion of their revenue. The other platforms should be as transparent as Intigriti about what they’re using AI for, and how they’re training and tuning their models.

• I watched the LHE kickoff call with my good friend Hakupiku (he’s also competing, and he lives in Japan now) in Hakupiku’s office. I’ve also been hanging out with Busfactor on most of the days since I arrived. It’s been a fun few days and it’s always nice to kill time with my close hacker friends in one of my favourite cities in the world.

Reading List

Resources

• PhoneLeak: Data Exfiltration in Gemini via Phone Call: I’m going to shout myself out here and link my own blog post. It’s worth reading, I promise.

• Trailing Danger: exploring HTTP Trailer parsing discrepancies: Absolutely brilliant research on a new type of HTTP request smuggling and header smuggling using Trailer headers. A real contender for next year’s Portswigger Top Ten.

• RCE in Google's AI code editor Antigravity: Hacktron AI’s recent research on Antigravity.

• Using HMAC collisions to forge password reset tokens: Very clever delimiter confusion technique from lil_endian. Very elegant!

MonkeHacks #92

Welcome back to MonkeHacks!

Most significantly this week, I launched Starstrike with Busfactor. I’ll talk a bit more about that below. It’s been an interesting week again. I was invited to a LHE in Tokyo that takes place in around two weeks, so I’ll be in Tokyo from Feb 10th to Feb 20th. I was already planning on going on my own dime from March 5, so you’ll hopefully see a lot of Japan in the upcoming issues.

I got a Fujifilm XE5 camera for a new project I’m working on this year, that I won’t be announcing yet. The immediate effect of this decision is that the photos you’ll see in each issue will drastically improve in quality. No more iPhone photos!

I took the Fujifilm XE5 out for a test run in Edinburgh.

Weekly Ideas / Notes 

• This week, I launched Starstrike with Busfactor. We also have a blog, although it’s empty for now. In the coming days, we’ll be publishing the first of our writeups. Our plan, roughly, is this:

  • We’ll pentest AI apps.

  • We’ll actively conduct research on frontier models to publish to our blog and spread awareness around AI security.

  • We’re working on a product suite to help secure AI systems.

• We have a few articles to publish, so we’ll be dropping one a week for the next few weeks. We’re looking forward to sharing these findings!

• I’m going to my first LHE of the year in two weeks in Tokyo. I decided to fly with JAL this time to see how their economy seats are. My personal opinion is: British Airways kinda sucks, but the movie selection is good. Air France is okay in every regard. KLM is okay overall, although the food sucks. Finn Air is good in all regards. Etihad is good, but the movie selection sucks. Unfortunately, on the way back I have to fly back via Charles De Gaulle airport in France, which is one of my least favourite airports in the world. You win some, you lose some.

• I’ve spent most of my week just doing a lot of writing, working on the 2026 methodology post as well as drafting up the research articles for Starstrike and fixing bugs in the site and blog. I did some hacking, but the next two to three weeks will be much more hacking-intensive, and I’m looking forward to it - there’s a satisfaction to getting your teeth into some good technical hacking.

• I set up OpenClaw; then I uninstalled OpenClaw. It’s incredibly insecure out of the box (like, you are one good prompt injection away from OpenClaw RCEing itself). I’m writing my own version for personal use that does something similar, but only has the features that I’ll actually use. OpenClaw is a glimpse into the future of prompt injections, I think.

• I went to the UK HackerOne Ambassador meetup in Manchester last week, and by some stroke of coincidence, James Kettle was there! I had a nice chat with him, and speaking with him has motivated me to do some research. I spoke with some more awesome people like XNL and stealthcopter too. All-round good vibes.

• The Disclosed newsletter compiled a resources document for beginners. You can find it here. It’s a nice, concise summary of what to follow in the sea of noise.

Reading List

Resources

• Well, Well, Well. It’s Another Day. (Oracle E-Business Suite Pre-Auth RCE Chain - CVE-2025-61882): Need I say it? More good Watchtowr research.

• Ticket Tricking OpenSSL.org with Google Groups: Old tricks still work! SpaceRaccoon is one of the OGs.

• GatewayToHeaven (CVE-2025-13292): A superb writeup on a cloud vulnerability in GCP. I am a big fan of these types of bugs.

• One-click RCE on Clawd/Moltbot in under 2 hours with Hackian: Ethiack’s hackbot hacked Clawd/Openclaw. We’re inching closer to sci-fi hackbots, I think.

• LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem): Liv Matan is a regular Google hacker and an excellent researcher. This is his latest work.

MonkeHacks #91

A friend of mine from Osaka was staying with me in Edinburgh this week, and I travelled with him down to London. My friend is a freelancer - more specifically, he works in the sustainability industry, and his main ongoing project is Igusabi - a startup aiming to use the leftover rush grass from the tatami production process to create other products such as furniture and clothes. I visited the Mills Fabrica, a coworking space near Kings Cross station specialising in sustainability, and later on we met my friend’s friend as well, who is building a startup for renting houses and apartments in western Ukraine. I really enjoy learning about what other people are working on.

The day after that, I flew to Copenhagen to visit some friends. I almost lost contact with one of my good friends living there, but I went on a fun side-quest to track him down. He had changed his phone number from a Japanese number to a Danish number, so my WhatsApp messages no longer reached him. I knew he used to go to a particular darts bar often, so I went to that bar and asked about him, and they had his Instagram account! So I was able to contact my friend again. I’m quite proud of that, as I could’ve lost contact forever if I hadn’t made that effort to reconnect. I flew back home to Edinburgh on Saturday.

Flying to Copenhagen from Heathrow Airport in London.

Weekly Ideas / Notes 

• I read the (relatively short 200-page) entirety of Rework by DHH and Jason Fried this week. Absolutely excellent book about business and running a company and things like that. The core message boils down to doing your own thing and not getting swept along with the startup fever, and focusing on what’s actually valuable, not just what people tell you is valuable. Anyhow, I highly recommend this book. It’s the type of content you want to shove into an LLM to keep yourself on track. I might do that.

• I read The Internet Just Watched Tony Robbins Try to Save Alex Hormozi's Soul and it’s quite insightful and profound. Highly recommended, I think we, as bug bounty hunters / hackers, tend to fall into this scoreboard trap too easily.

• It’s been a very slow month of hacking for me. Hopefully things pick up a bit in February. I still have 4 days to find some cool stuff, though, so I might lock in a bit and grind out some bugs.

• I hate taxes. That is all. I’ve been knuckling down on the admin work I’ve been procrastinating on, and I’m caught up on nearly everything now, but it was such a hellish process that I’ll almost certainly vibe-code something to remove the friction involved.

• I’ll be dropping something very fun this week. Stay tuned.

Reading List

Resources

• Attackers With Decompilers Strike Again (SmarterTools SmarterMail WT-2026-0001 Auth Bypass): Nice technical writeup on RCE in SmarterTools SmarterMail.

• Stealing Salesforce OAuth Tokens using the WAF: Castilho weaponised Cloudflare’s WAF to prevent the OAuth flow from consuming the code. Very clever trick.

• hacking clawdbot and eating lobster souls: Some misconfigurations in clawdbot, namely publicly exposed dashboards and such. Pretty serious.

• Cloudflare Zero-day: Accessing Any Host Globally: This is a type of vulnerability I really like - a routing misconfiguration. It’s a good read.

• Summary of CVE-2026-23864: More React vulnerabilities, some of which were found by the legendary Ryotak.
  

MonkeHacks #90

It seems that I never have quiet weeks. My cats got bored of their food so I had to rotate to a new brand to keep them fed. The weather warmed up by a few degrees again, although it’s still grey and dull.

On the 21st, I’ll be flying to Copenhagen to visit some friends - if you’re based near Copenhagen and want to hang out, send me a message! I’m flying back to Edinburgh on the 24th.

A street view of Edinburgh’s old town.

Weekly Ideas / Notes 

• I got a Polar H10 chest strap heart rate sensor. Chest strap sensors are the most accurate sensors you can get - Apple Watches are okay but chest straps are the superior option (and relatively inexpensive). I still wear the Apple Watch during exercise for the GPS functionality. There were a few numbers I wanted to measure - my maximum heart rate (MHR) and resting heart rate (RHR). My dad and my brother are both very athletic, and so I was following their guidance on this. These numbers, plus the changes in heart rate depending on my state of activity, allow me to quantify my aerobic fitness. If you’re doing any kind of running training I would strongly recommend getting a chest strap heart rate sensor - you can track your physical health much more accurately. That being said, all I learned from it this week was that I am quite unfit - I wore it to my soccer game, and my recovery between sprints wasn’t very good, but this is thankfully something I can improve by doing light runs in the gym every few days.

• If you tuned into the Critical Thinking Charity Hackalong - thank you! We had a few findings across the 10 hours of cumulative hacking we did, and there was consistently 70-100 people online at any time. That’s an impressively large audience. I had a ton of fun doing my 2hr session of hacking (server-side by overwhelmingly popular demand, as they had 4 hours of client side before that) and we found some interesting leads. Again, thank you for tuning in!

• I should be at the Manchester meetup on January 31st with the UK Ambassador club. I’m forward to seeing some familiar faces again.

• The Hackalong kicked me back into gear for bug bounty. I’ve stopped doing much hacking outside of LHEs, but I miss constructing crazy chains. I want to cook this year, and I don’t want these to be empty words.

Reading List

Resources

• Achieving remote code execution in LangSmith Playground using unsafe template formatting: Awesome research from the CTBB lab.

• Gift cards security research: This is a pretty great lesson on ROI; most hackers seem allergic to the concept of spending money to make money.

• Pwning Claude Code in 8 Different Ways: Ryotak is unstoppable. No, seriously. He’s like some kind of high-power hacker laser-beam that you can target at attack surface to annihilate it.

• Breaking Multi-Tenant Isolation in Heroku Postgres: A classic Postgres privilege escalation in Heroku using definer functions.

• BodySnatcher (CVE-2025-12420): A Broken Authentication and Agentic Hijacking Vulnerability in ServiceNow: Aaron Costello at AppOmni (my old workplace) found a critical issue in Servicenow within their AI products.

• Copilot or Coconspirator - Tricking GitHub Copilot and Stealing all Your Secrets: My friend Adnan Khan with another fantastic piece of research on Github.

• Youssef Sammouda dropped EIGHT writeups this week for bugs he found on Meta. This is must-read content; Youssef is a client-side master.

  • Multiple XSS in Meta Conversion API Gateway Leading to Zero-Click Account Takeover

  • Two-click Facebook account takeover via FXAuth token and blob theft

  • Datr cookie theft and AI leads to Facebook account takeover via trusted device recovery

  • Self-XSS in Facebook payments flow leads to Instagram and Facebook account takeovers

  • Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number generator and XSS in Facebook JS SDK

  • Instagram account takeover via Meta Pixel script abuse

  • Multiple cross-site leaks disclosing Facebook users in third-party websites

  • Leaking Meta FXAuth Token leading to 2 click Account Takeover

    
    

MonkeHacks #89

Welcome to the first issue of 2026. On the personal side, I caught a mild cold, and I spent some time doing personal finance optimisations to reduce my expenses and such (like a spring cleaning of my subscriptions). I’ve been exercising every other day this week (gym, bouldering, soccer) and I’m happy that I’m sticking to my new routine.

I’ve had a relatively productive week, but I’ll discuss more on that below. The temperature has dropped sharply, and the harbour near my apartment has frozen over entirely. It’s around 0°C or 32°F in Edinburgh right now, with heavy snowfall further north in Scotland. I watched Marty Supreme in the cinema this week - excellent film. Highly recommended.

The Sherlock Holmes statue in Edinburgh with a cone on its head.

Weekly Ideas / Notes 

• Before we get to the main content - you may notice that this issue looks different. This is because I upgraded to the paid plan on Beehiiv, which has a much better site builder and proper analytics. I’m happy to announce that Bugcrowd will be sponsoring this newsletter from the next issue! I don’t make money directly from this newsletter, and this sponsorship is just to cover the cost of the upgraded Beehiiv plan. If there are any leftover funds from the sponsorship, I’ll put them towards a giveaway or something similar, that gives back to the hacker community. I’m hoping to write more technical content this year, so look forward to that!

• I got this Japanese Cherry Blossom Landscape Lego set for myself as a decorative piece after one of my friends described my apartment as “as soulless as a Soviet block”. I’m looking forward to building this thing.

• I spent quite a few days this week upgrading how I use AI in my hacking workflow, after speaking with xssdoctor. I’m currently running Caido and Claude Code from my Raspberry Pi that I host in my bedroom. It’s a pretty nice setup, and I’m adding more capabilities to my AI automation at the moment. I have the architecture drawn up in my notebook, and now it’s just a matter of implementation. Raspberry Pis are amazing for scripts that don’t require much compute power. They’re cheap and consume next to no electricity.

• Following this train of thought, it’s more and more clear to me that this year, the most efficient hackers will be the ones who operate agents that have high-quality notes powering them. So take good notes! Take organised, thorough notes! You’ll need them. You can’t trust just anyone’s notes - because if you do, you open yourself up to a prompt injection supply chain attack. Write them yourself, build your portfolio.

• Next week, I’ll be doing a Hackalong shift for the charity Hackalong over at Critical Thinking. The imposter syndrome is kicking in a bit but I’ll do my best. Do tune in, it’s for a good cause and you’ll definitely learn something with the lineup we have for the day. More on that soon.

• I read somewhere, or maybe it was in a few places, that part of the reason people feel overwhelmed is because they have “open loops” in their mind, such as unfinished tasks or projects. I like this analogy, and it certainly holds true for me, so I’m going to spend the next week closing some loops before I continue working on my startup or AI project.

Reading List

Resources

• 0day speedrun? OpenFlagr <= 1.1.18 Authentication Bypass: My friend DreyAnd found a 0day very, very quickly. Drey is one of the best young hacker talents around - he does CTFs with Project Sekai.

• Top 10 Web Hacking Techniques of 2025 - Nominations Open: Portswigger’s annual list, which is always among the best content of the year, is taking nominations for their 2025 edition. They’ve listed a few great articles there (some of which I’ve completely missed) so take a look!

• Never Trust the Output: Data Pollution in AI Agents and MCP: Slonser with a new AI hacking technique! Slonser always produces excellent research.

• Intigriti December 2025 XSS Challenge Writeup by J0R1AN: A gargantuan client-side hacking writeup, a masterpiece of CTF. Very very nice.

  
  

MonkeHacks #88

You’ve reached the end of the year. Great job! Keep going.

In the past week I spent my Christmas here in Edinburgh, but I returned to Cork from Dec 27th to Dec 29th to visit my relatives. I took a good break this week and spoiled myself a bit. My Christmas present to myself was the paperback version of the 40th anniversary edition of Phrack 72. I’ve read a few articles from this before, which I’ve covered in this newsletter, but I look forward to reading the entire issue from start to finish. The temperature here dropped sharply towards freezing, but thankfully it’s been dry and not too icy. I listened to the Acquired podcast episode on Visa, which was really interesting - have you ever thought about how Visa was founded, and how it operates? Probably not. It’s really cool.

That aside, it’s time to review 2025. An incredible year for me, and I hope you had a great year too.

This innocent face hides a mind of evil and chaos.

Weekly Ideas / Notes 

Reviewing 2025

• I won’t disclose my income, but I absolutely shattered my goals. This was a split between bug bounty and consulting/pentesting.

• I attended 5 LHEs! Tokyo, Las Vegas, Mexico on the Google side, and Sydney and Amsterdam with HackerOne. This yielded one MVH, one Most Creative Finding, 2nd Place and Best AI VRP Researchers.

• I adopted two kittens. They’re growing very fast and it’s been very fulfilling to have them around, although taking care of them is a tremendous amount of work.

• I’m definitely in better shape than I was at the start of the year. I was lifting quite consistently for a few months this year, but I lost the discipline and I’m weak again (aside from the bouldering muscles). I’m determined to get back to lifting in January. I play soccer every week now, which is fantastic aerobic exercise, and I’m still bouldering weekly as well. But lifting eluded me and I WILL get back to it.

• I’ve been budgeting with YNAB very consistently for the last few months. I am broadly in control of my finances, although I’ve been working hard to do better financial planning this month. This is important to me as it enables everything else in my life.

• My 1,600-day Duolingo streak has continued with a Perfect Streak (no streak freezes used) of 90 consecutive weeks. I still journal daily, which is now at 2,200 days. In case you couldn’t tell, I like compounding habits.

• I visited some very interesting places - Mexico, Australia, New Zealand, Taiwan, and Japan to name a few. I expect to travel quite a bit less in 2026 as I have pets now.

• I spoke at several conferences - I gave a workshop at Bsides Dublin, spoke at HackAICon in Portugal, and I was a main stage speaker at the Irish government’s national conference in Dublin. This ticks off one of my goals at the start of this year.

• I started learning guitar and going to therapy. I take weekly guitar lessons, and I go to therapy every two weeks. Therapy has been a fantastic addition to my life - I know myself very well now.

• In short: it was a very, very good year for me. I feel that I’m much more aligned to where I want to be in life. There’s always more work to be done, though, and that’s the next section.

2026 Plans

• I’m in control of my finances right now, but I’m not investing anything, so I’d like to fix that soon. Given that my income is irregular, this requires some chats with my accountant, which I anticipate doing in January once I’ve done some more research.

• I want to set new PBs in running and lifting. I know I can do it - I had a good streak of lifting in 2025, but I want to firmly make it a good habit of mine in 2026.

• I’m intending to tie it all together with some kind of “Life Dashboard”. I want to link YNAB to my Notion, or perhaps just a vibe-coded UI, and track my progress in every aspect with proper numbers. Notion is probably the easiest option here. I can track my sleep/heart rate and such with my Apple Watch and a third party app called Bevel, which basically imitates Whoop in setting “scores”. I dug up my old sunrise alarm clock from Lumie, so that’s set up by my nightstand now to wake me up more naturally. I need to look at what Bryan Johnson (the immortal unc) is doing - he makes extensive use of things like biomarkers, and while that’s an extreme, I need to at least take a blood test soon to identify any problem areas.

• I want to maintain a strong financial performance, and to continue diversifying my income. My startup has some problems in scaling that I need to solve first before I can post about it.

• And finally, in 2026, I want to act on a longtime goal of mine, and try to create a documentary of some kind. I hope to cover my entire 2026, including any Live Hacking Events and my travels. I have a vision for how I want to do this. Time will tell if I can do this idea justice, but the objective is to meet and interview some hackers around the world to show everyone the people behind these handles, as well as to weave it into a narrative through my adventures.

• Overall: my focus for 2026 is to spend less time working, and more time building up other areas of my life. I want to apply the Pareto Principle and reduce myself to the 20% of work that brings 80% of the income. Like pruning a bonsai tree. A “re-alignment”. A life lived with intention is a life well-lived.

Here’s to 2025, and here’s to a good and hopefully peaceful 2026. I turn 25 next year, and that thought makes me feel old. The kind of lifestyle I live is quite disjointed, and time doesn’t flow very smoothly for me. I think I need to fix that. I wish you the best and have a great new year.

Reading List

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (265/400 pages)

    • Founders At Work by Jessica Livingston (190/472 pages)

Resources

• Cross-Site ETag Length Leak: This is a ludicrously clever technique. Not very useful in bug bounty, but the ingenuity behind it is brilliant.

• Can you compromise a multi-billion dollar company via /health?: I think you can guess the answer.

• how to hack discord, vercel and more with one easy trick: An excellent writeup about vulnerabilities in Mintlify that led to RCE in a variety of platforms.

• MongoBleed explained simply: MongoBleed was a dangerous vulnerability in MongoDB that emerged this week. Unfortunately they published it on Dec 26, so everyone had to go straight back to work to patch this after Christmas.

• bugbounty.forum: A very interesting new forum site launched by my friend Pomme. The concept is simple: it’s anonymised, but you can verify your earnings via DKIM records to have your bug bounty income amount next to your name, which adds weight to your words. Unfortunately my earnings are all in Protonmail, which tampers with the DKIM records, so I can’t sign up to this site.

  
  

MonkeHacks #87

It’s been a pretty stressful week (and a half) for a number of reasons, mostly related to my two cats. Meap recovered perfectly after his emergency vet trip, but then Tora had some nausea from a hairball so I had to feed him one teaspoon of food at a time. I was back in Ireland for two to three days to visit my family before Christmas, so the cats were in the care of some close friends. The two stinkers have both recovered now, and they’re back to normal - which I’m very thankful for.

I’ve been working on a pentest this week - a bunch of payments from previous months all paid out this month, so on paper I’ve had a very successful December. I’ll do a “Year in Review” in the next issue (hopefully around Dec 29th or 30th). And what a year, honestly. I demolished my goals.

I’ve been working on a lot of things on a number of fronts; I’ve started setting up my next AI research topic, and I’ve been working on my startup. I expect to publish some research and provide some more details on my company in January. Stay tuned!

Another Christmas season in Edinburgh. The lights are nice as usual.

Weekly Ideas / Notes 

• I’ve had to turn down some good freelance opportunities this week due to having too much on my plate. It’s a bit frustrating because security work seems to come in bucketloads all at once, and then there can be nothing at all for a month. It almost feels like throwing money away. It’s not work that I can outsource or subcontract either, because it’s work that’s specific to my skillset.

• I might redesign this newsletter soon with the Beehiiv website builder. Up to this point I’ve been using the free version (I’m cheap), but I’m fast approaching 1,000 readers, so it’s about time I upgrade this thing. If you’re reading this and you’re interested in sponsoring this upgrade, do reach out to me on X. This newsletter has some pretty good stats.

• Part of my mission with this newsletter is to bring some small changes that can have a radical quality-of-life improvement. This week I’ve been thinking about how naivety can be a superpower. There’s a lot of power in not knowing how you’re supposed to do something. It blows away any flawed conceptions held by the masses, and often you arrive at a more direct solution than the status quo. Take, for example, startups. The “common knowledge” is that you go and take VC money. But the naivety route is, asking yourself why you even need VC money. Just because nobody else does it, that doesn’t mean your path is wrong. It’s just different. Have the confidence to try things that are different. This works for bug bounty too. Take the weird path that other people aren’t thinking about. That’s where the bugs are.

• NahamCon Winter Edition starts this week! NahamCon is always full of interesting talks and knowledge, so do not miss this. It’s free. I repeat, do not miss this. It is FREE.

• Caido now has a plugin for taking neat screenshots of HTTP requests! This looks REALLY useful. Redacting requests for reports is now vastly easier to do.

• From my friend m0z on X: “In case you didn't realize, referrerpolicy attributes take precedence over policies defined in meta tags or response headers”. This is a VERY useful client-side trick; he points out that it means that provided that you can bypass the CSP, you can always leak query parameters from the current page if you have a HTML injection.

• From Nowasky: “Anchor/area tags can leak page URLs (origin, path, query, post-click fragment) by using href="#" with the ping attribute pointing elsewhere.” These are useful client-side gadgets if you have partial or full HTML injection. Put them in your notes! You may not need them now, but I promise you that you’ll need them in the future.

Reading List

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (265/400 pages)

    • Founders At Work by Jessica Livingston (190/472 pages)

Resources

• SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL: WatchTowr back with more impactful research. This time, it’s a new primitive in .NET request handling that led to some cool bugs in various pieces of enterprise software.

MonkeHacks #86

It was a pretty interesting week - I gave my talk at the Irish government’s annual cybersecurity conference in Dublin to several hundred people, easily the largest in-person conference I’ve ever spoken at (Nahamcon was comparably large but that was virtual). I spoke about my career, bug bounty and a small bit on AI security. I met some very cool people - such as the senior staff from the Japanese embassy. Incredible event, all in all.

My cats are still recovering from their neutering - Tora is fine, but Meap had a minor complication. Unrelated to his recovery from his operation, he threw up this morning and he was very lethargic, so he’s spending the night at the emergency vet tonight. I’m very careful with what I leave lying about around the cats, so I have no idea what the root cause is, but I think he’ll be okay. Not that it makes the whole experience any less stressful.

Raising two kittens is like pseudo-fatherhood. It, of course, cannot be compared to actual fatherhood, but this is a crash course on how to care for another living creature. This feeling of responsibility alone has taught me so much in the last month.

In a stunning demonstration of how laziness can lead to innovation and efficiency, instead of learning to type on my new keyboard, I've turned to using voice dictation to dictate this newsletter instead. This is much faster than typing it out (even on my old MX Keys keyboard!). It also allows me to articulate my thoughts more succinctly.

73,000 people at Manchester United vs West Ham in Old Trafford. Unforgettable.

Weekly Ideas / Notes 

• This week, my thoughts drifted to Waymo. I've been thinking about how this technology might impact our day-to-day lives. It strikes me as something that could radically upset how we currently use private hire transport. I know it's already in use in San Francisco and London and, evidently, it's going to spread to more parts of the world soon. This is, really, an existential threat to Uber. I think it's important to look ahead by two or three years within reason, and try to envision the world that we COULD live in because this can help you to make decisions that you make today. For example, if there was a large-scale solar event that wiped out computers worldwide, how screwed would you be for finding a job that isn't at a screen? Obviously this is an extreme example, but it's good to think about these things.

• I went to watch Manchester United vs West Ham with my best friend. Manchester United drew 1-1, which was unfortunate, but I'm glad I saw a goal. On the way back to the city, there was a really, really long walk of about 10,000 people forming a steady stream of football pilgrims after the game. This pilgrimage back to the city really impacted me. It was like this ritual that no one ever talks about, and I had the fortunate opportunity to experience it myself. These are the small pockets of unforgettable experience that every traveller is looking for on a trip.

• The reaction to React2Shell reminds me of Log4j. There is this initial flurry of automation, and then large programs start reacting in a panic. Vercel opened a bug bounty program just for bypasses. Now, the proof of concept was not as immediately public as Log4j was, but this is evidently still a very serious issue. With major vulnerabilities like these, there's always a feeling of FOMO. But at the same time, there are other opportunities that I haven't missed. You can't catch every train that comes your way. These are the shiny things that can distract you from your core mission.

• I had a moment of reflection after being on stage in Dublin about where my life is going and how my life has led to this point. It's really not something I could ever have envisioned when I was getting into bug bounty or security in general. You can't really predict what opportunities you'll get in the future. You can only live your life in such a way that will 1) bring you more opportunities and 2) put you in a better position to use them. That's my general philosophy: to be well-prepared. With preparation, I can be better positioned to seize those opportunities when they arise. And if you're not prepared, well, you really have no one to blame but yourself. Or myself, in this case.

• The building I live in now has some of the best views anywhere in Edinburgh. The terrace opened very recently and no one has been booking it, so I’ve been working from it occasionally. I find that my problems and worries seem so unimportant when I can see the world sprawling out before me. Views are important. Once I can drive, I’ll go hiking.

Reading List

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (265/400 pages)

    • Founders At Work by Jessica Livingston (190/472 pages)

Resources

• SVG Clickjacking: Clever new technique discovered in the course of recreating Apple’s Liquid Glass effect.

• React2Shell: read about it on the original author’s site, linked here.

MonkeHacks #85

Late issue this week - apologies. My cats got neutered and are currently wearing cones and looking very stupid. As such, I can’t make it to the UK H1 Ambassador Meetup in London this week.

It’s been another really busy week, with pentest work and moving more things, the cats settling in, and setting up my new hacking gear. My mom is also visiting this week from Cork, so that’s been quite nice.

Next month I’m going to take a big sabbatical to focus on admin work and resting before 2026. I’ll still post my newsletter with resources.

The two stinkers with their cones of shame.

Weekly Ideas / Notes 

• My good friend Vitor built Bug Bounty Daily - a writeup aggregation site. He’s just launched a digest newsletter here. Honestly, it makes my resource aggregation a lot easier. Go and subscribe to it if you haven’t already.

• In line with the rest of my office upgrades, I’ve bought a Kinesis Advantage360 keyboard. Why? Well, I realised while I was buying all of this stuff that my ergonomics and posture absolutely suck. I may not feel the pain now but it was clear to me that I would be in for a bad time if I kept this up. Working from a laptop in small bursts is convenient but long-term, it’s a recipe for disaster. The new keyboard is a split keyboard, which makes typing SO much slower while I adjust to the difference but will hopefully pay off in the long run. Even typing up this newsletter is taking forever, so I expect it to take a few weeks before I get anywhere close to my old typing speeds again. I’m back to about 40wpm when I could reach 140wpm before.

• I got my mini-PC - I have a Beelink SER8 with 64GB RAM, 2TB storage and a Ryzen 7. I installed Omarchy on it, which is really smooth to work with and honestly? I’m not turning back from Linux now. It’s just much, much faster to use Linux’s window management systems over MacOS. It’s not even close. I opted for 2TB because Caido projects tend to use up a lot of storage (storage is cheap, so this isn’t a problem). So far, I’ve installed Caido and set up a shortcut to open it. I also have a shortcut to open Gemini and Notion, as well as HackerOne and Bugcrowd. It’s pretty sick. Between the keyboard and maining Linux now, if I stick with these habits, the gains are going to be massive in terms of workflow friction reduction.

• Joseph, a.k.a rez0, posed the interesting question of whether or not prompt injection itself is a vulnerability. I think it usually isn’t, but it can be in certain situations (such as log poisoning).

• I’ll be speaking next week at the Irish Government’s cybersecurity conference. More on that next week. The days after that, I’m going to Manchester with my best friend to watch Manchester United vs West Ham in Old Trafford. As a Man Utd fan, I’m really looking forward to it.

Reading List

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (265/400 pages)

    • Founders At Work by Jessica Livingston (190/472 pages)

• Next on the list:

  • Fiction: Mort by Terry Pratchett

  • Non-Fiction: Day Zero to Zero Day by Eugene Lim (SpaceRaccoon)

Resources

We’ve been spoiled for good content this week!

• Reflection on Ryan Barnett: Ryan is a well-known figure in the bug bounty community, particularly because he works for Akamai and regularly engages with the researcher community to improve security globally. This brief article is about how he got into the field.

• Abusing the NinjaShell API for Code Execution in Google Web Designer: Sudi, building on the research of my friend Balint, found an RCE in Google Web Designer.

• Who Needs a Blind XSS? Server-Side CSV Injection Across Support Pipelines: This is a very clever new technique abusing the fact that spreadsheets can do operations like importHTML or importXML to leak data. I won’t spoil it - you can read it at the link there - but it’s very innovative.

• Exploiting A Pre-Auth RCE in W3 Total Cache For WordPress (CVE-2025-9501): Brief article from MrTuxRacer on a pre-auth RCE POC he made from a CVE reported by wcraft.

• Unlocking Reflected XSS in the Astro framework: Technical writeup from - you guessed it - zhero, back with another bug in a Javascript framework.

• Breaking Oracle’s Identity Manager: Pre-Auth RCE (CVE-2025-61757): SLCyber, formerly Assetnote, with another highly technical blog post. You’ve got to appreciate the technical depth of these articles. It’s truly an invaluable resource for studying code review in older technologies.

• How I Found the Worst ASP.NET Vulnerability — A $10K Bug (CVE-2025-55315): Request smuggling in Kestrel - pretty serious!

MonkeHacks #84

Welcome back to MonkeHacks. It’s been a really hectic week - I moved into my new apartment so that took up a lot of my time. I also did two talks and a HackerOne pentest. I was supposed to fly back to Ireland this week, but I ended up cancelling that plan; I have to catproof the new apartment properly, and the cats have started to become more needy. Now I feel that this was the right decision.

One of my close friends was visiting me this week, and we conducted an experiment. First, he left the room. The cats stayed where they were. Then, he returned, and I left the room. The cats followed me and meowed at my door. So, in short, the cats love me (obviously). It’s all very wholesome. Every time I get home from being out and about for a few hours, they’d go to the litter machine as soon as they saw me. So I wondered, why does this happen? I googled it, and it turns out that the cats trust me so they want me to “stand guard” while they’re vulnerable as they use the litter box. Of course, I oblige. I stand guard for them while they poop. Anything for the little ones.

You may have noticed that the cover image of this edition is a giant ferry. Allow me some time to talk about what it actually is. If you’re reading this, Shubs, or other Australia-based hackers like Animesh, this might interest you.

That ship is the Spirit of Tasmania V. The Tasmanian Government were looking to upgrade the ferries that operate between Sydney, Australia and Devonport, Tasmania (currently the Spirit of Tasmania I and Spirit of Tasmania II) with the new ships, built in Finland, called Spirit of Tasmania IV and Spirit of Tasmania V, to cover the 11-hour journey across the sea. Unfortunately, this whole saga has been riddled with problems. The port upgrades in Devonport weren’t completed on time, so the ships can’t operate yet. IV is currently parked in Hobart, Tasmania, but V suffered some problematic issues. The ship had a faulty LNG (natural gas) system, so it had to be repaired. There’s nowhere to park the ship in Tasmania yet, due to the aforementioned port upgrades, so the ship is currently docked in Edinburgh, very close to where I live, for storage (it’s cheaper than moving the ship to Australia right now). It’s a giant ship. It weighs 48,000 tonnes and it’s designed to carry vehicles, as well as having hundreds of cabins for passengers.

But that’s not all! It was supposed to cost $90m AUD, but due to the upgrades, repairs, docking fees, and so on, it’s now cost $493m AUD. It won’t leave Scotland until mid-2026. TT-Line, the parent company, lost so much money doing this that they had to be bailed out by the Tasmanian government. There was so much uproar over this entire situation that several important people lost their roles - the deputy minister for infrastructure (in a vote of no confidence), the chairman of TT-Line, as well as the CEO of TT-Line. This whole saga was a catastrophe from start to finish.

So now, it’s docked in Leith, right near my apartment, and I get to watch it from my window and think about how much the Tasmanian government screwed up. I can see the ship from where I’m typing this up. Maybe if I hop on board I’ll get to hang out with Shubs and Animesh again?

The Spirit of Tasmania V, docked near where I live in Leith, Edinburgh.

Weekly Ideas / Notes 

• I posted this tweet about my journey into cybersecurity in greentext format. Enjoy! 😋 

• I moved into my new apartment. It has a view of the harbour, and double the floor space of my last apartment. The cats have a lot more space to run around when they get the zoomies. In short: this was a great idea. With the exception of my inability to drive, this is pretty much where I wanted to be in life when I was 17 and had big dreams - renting a nice flat, with cats, self employed and making good money. Life is pretty damn good right now. Approximately 40% of my income this month has come from things like talks, workshops and content so my income diversification effort is going in the right direction. I’m locking down my budget as well to track my income and expenditure properly, although there are a lot of irregular expenses right now with the move and such.

• I set up my office with two 27-inch Samsung monitors. I already have the MX Keys keyboard and the MX Keys Mini keyboard for when I’m on the go, and I use the MX Master mouse as well. I should probably switch to something more ergonomic but for now, this works pretty well. I have 900Mbps internet speed now over Ethernet but apartment building is pretty new and the wifi doesn’t really reach me yet, so I’m waiting for them to fix that. This new setup should have a big impact on my productivity - previously I was only using my laptop, so having two monitors is a game-changer. Now I can browse the web and view Caido at the same time, instead of switching tabs every two seconds! Crazy!

• Apart from a few ongoing security projects this month, I’m going to take some time away from bug bounty to focus on organising my workflows, moving everything into my new apartment and helping my cats to settle in. This is my restructuring time before I go back into bug bounty in December with a more refined and efficient workflow. I’ve made enough to cover my expenses for the month, so I can spend some time ironing out the processes in my life.

• My Christmas present to myself is to get a mini-PC. I’m intrigued by the ones that DHH recommended but I’m open to hearing other suggestions, if anyone is particularly passionate about a specific brand or model of mini-PC. I want to chuck Omarchy onto it and build a hacking environment. I’ll talk in-depth about this as I do this.

• I’m going to start my pwn journey soon. It’s a little tricky to figure out where to start, as with anything, but I’ll probably start looking at x86 assembly instructions and trying out some exercises to intuitively grasp how they work and to add their common design patterns to my mental context.

• I got through more of Founders at Work this week. It’s an excellent book - a bit dated, sure, but the takeaways are timeless.

• I talk a lot about balancing priorities, so I’ve graphed it out in terms of how it applies to me so you can better understand how I structure my life. I have very clear “categories” in my mind for what I need to manage effectively. There are a number of smaller forks from this graph (such as using YNAB for budgeting, or the mini scripts I’ve written that sync things like YNAB to my to-do list, and so on) but this is the core of it.

I suppose, if I had to graph it, my daily life looks something like this.

Reading List

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (232/400 pages)

    • Founders At Work by Jessica Livingston (181/472 pages)

• Next on the list:

  • Fiction: Mort by Terry Pratchett

  • Non-Fiction: Day Zero to Zero Day by Eugene Lim (SpaceRaccoon)

Resources

• Linux in a Pixel Shader - A RISC-V Emulator for VRChat: Not security-related, but this is one of the most insane projects I’ve ever seen. I loved it.

• Astro framework and standards weaponization: Clever manipulation of parsers and standards from zhero led to some really nice findings on Astro.

• Disrupting the first reported AI-orchestrated cyber espionage campaign: Anthropic discovered that a threat actor was using their models to conduct entire espionage campaigns. The implications of this discovery for the cybersecurity space as a whole is very interesting.

• AuxClickjacking: Rafax developed a new technique for drag-and-drop exfiltrations. His example POC is very clever.

• Can AI Find Zero Days? I Tested It On My IoT Camera: Matt Brown, acquaintance of mine, posted a video on his usage of AI in his work in IoT hacking. Super interesting.

• Hacking Gemini: A Multi-Layered Approach: Valentino’s research on Gemini and some of his findings there.

MonkeHacks #83

Late issue again as I had the H1-3120 Live Hacking Event in Amsterdam, hacking on Salesforce’s AI scope. My team (busfactor, rafax and myself) put in a strong performance (I think!). I’m back in Edinburgh again now, and this week I’m moving to my new apartment (it’s pretty close to my current one). The cats have settled in pretty well.

Girl with a Pearl Earring, Mauritshuis, The Hague, Netherlands

Weekly Ideas / Notes 

• I had H1-3120 in Amsterdam this week! I had a fantastic time onsite. There’s a few familiar faces I’ll only see once or twice a year as a result of attending these events, so it was great to see the hacker friends and acquaintances again. Once you’ve been to more than one LHE, you recognise the regulars, and they recognise you, so it becomes this fun reunion occasion. The scope and program experience can have ups and downs in various events but the on-site experience is always really fun. Amsterdam, in particular, was familiar territory to me, as I’ve lived in the Netherlands for long enough to know how to get by there. It was like the Edinburgh LHE last year - when you know a city, it’s easier to focus on the hacking part.

• I went to The Hague this week with Busfactor and Rafax - I showed them my old apartment, we went to my favourite cafes in the city, and we saw the Girl With a Pearl Earring painting in the Mauritshuis gallery. I’m thankful that my two teammates tagged along on my nostalgic little daytrip back to Den Haag. It was a good day out.

• I’m firmly in recuperation mode after the intense hacking period of the last two weeks or so. Well, my idea of recuperation is doing less intense/high-pressure work, and spending more time unwinding and getting through administrative stuff, so that’s what I’ll be doing this week.

• I’m thinking about what to set up in my planned office. There’s a big difference between what I want and what I need. At the very least, I’ll need two monitors, and I’m strongly considering getting a relatively cheap mini-PC so I can load Omarchy onto it and do my day-to-day hacking on Linux. I’ll probably need to get an ergonomic chair as well. I’m still hacking from cafes without any external monitors so I’m probably sacrificing a good deal of productivity. The recent CTBB episode talks about reducing friction and I definitely need to embark on a friction-reducing mission this month to streamline my processes.

• Conversely, it’s pretty easy to focus on the wrong things and spend too much time optimising. This kind of optimisation gives you the illusion of productivity ("this will pay off eventually!”) when in reality, you’re just giving yourself an excuse to procrastinate. It’s like spending money. There’s a balance somewhere between spending and saving, and likewise there’s a balance somewhere between doing things and optimising your processes. So much of overall success is dependent on properly hitting this “rational balance” of planning and doing. It takes a significant amount of self-reflection to identify when you’re not hitting this balance properly.

• I’m working my way through Founders at Work and the number of startups that were founded from a bunch of people going “let’s build something cool” and then just… executing on an idea is really surprising. It’s pretty clear to me that the people who just do things instead of dwelling on things too much are the ones who succeed in the long run.

Reading List

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (232/400 pages)

    • Founders At Work by Jessica Livingston (172/472 pages)

• Next on the list:

  • Fiction: Mort by Terry Pratchett

  • Non-Fiction: Day Zero to Zero Day by Eugene Lim (SpaceRaccoon)

Resources

• Claude Pirate: Abusing Anthropic's File API For Data Exfiltration: wunderwuzzi’s most recent blog post. Johann’s work is must-read content for anyone who’s interested in AI hacking.

• HackedGPT: Novel AI Vulnerabilities Open the Door for Private Data Leakage: Tenable’s research lab found a few vulnerabilities in ChatGPT. Nothing super technical, but good work nonetheless.

MonkeHacks #82

Welcome back to MonkeHacks. Given that it’s LHE season, it’s been very busy with working and other things. The cats are settling in well, although I’m moving soon so they’ll need to re-settle in the new flat. My guitar lessons have been progressing smoothly - I can now do barre chords properly, so it’s just a matter of increasing my repertoire of songs at this point. Steady practice, as with everything else in my life.

I held a poll on X to decide my next project, and the winning option was to learn reverse engineering and take part in Pwn2Own in 2026. I’m interested in pwn as a field, so I’m looking forward to it - in parallel with that, I plan on gradually building my startup and focusing on Google’s VRP for the first few months of next year. Once I’m moved into the new flat, I plan on taking a few days to just… organise my many ongoing projects properly. Those aren’t the only projects I want to do in 2026, but I’ll save those surprises for next year.

A plane I saw from a plane this week, en route to Dublin.

Weekly Ideas / Notes 

• I returned to reading this week and made some progress on Founders at Work and How The World Made The West. I was inspired to read Founders at Work when someone - I forget who it was - mentioned Raphael Mudge’s blog, and cited his writing as being very good. You can find the blog here. Mudge is the creator of Cobalt Strike; and I liked what I saw in his “Favourite Books” section, so I’ve decided to read them. I should really just put the books I read on a Goodreads profile and link that instead.

• I gave a talk in Technological University Dublin (TUD) this week to a few dozen students. I met some folks who read this newsletter every week - shoutout to you guys, you were awesome - and I spent two days in Cork afterwards, visiting my family. Cork’s Jazz Festival was happening so it was really busy but I made it anyway, and flew back to Edinburgh on the 26th.

• I’m in the middle of taking part in HackerOne’s latest LHE. The scope and policy is quite unusual, so it’s been an interesting event (in neither a good nor bad way). I’m collaborating with busfactor and rafax. I’m an honorary Brazilian.

• I’m moving into a new flat soon - I ended up not flat-sharing due to logistical problems. I’m betting on the fact that I should be more productive in the new place, to cover the difference in rent. Still well within my means, but it’s never fun to have to fork over more money.

• I wrote a pretty fun script: I moved my To Do List from Apple Reminders to Notion. Why Notion? Well, they have a concept called “databases” for storing items, and a friend of mine helped me to set it up last year (he had a whole side gig on converting companies to Notion). In his "system”, every task is linked to a Project and every Project is linked to a Goal, so the accountability is pretty good. Anyway, I realised that Notion has an API, so I wrote a script that polls my YNAB account for new transactions, then creates a new task in my Notion if there are any actionable items (like categorising or approving transactions, for example). I run it in a DigitalOcean serverless function, although you can easily just run it locally in a cron job. When there’s so much data in these APIs, I want to start pulling them into a universal dashboard soon that I can put somewhere in my apartment to see everything at a glance.

• Getting the cats actually increased my productivity because I’m awake from 6:30am or 7am every day now. I mentioned this last time too, but early starts are a complete gamechanger for productivity. When I have to do some cat-related chores before breakfast every day, it sets the right frame of mind for me to take action rather than procrastinating for a few hours.

• Once the LHE is over I’ll do a new edition of my Bug Bounty Methodology blog post to reformat it and update the content. So as usual, stay tuned!

• My decision to learn pwn might confuse some, but I see it this way: in an age where core skills, like programming, are being replaced by AI, I want to move in the opposite direction and learn skills like pwn from first principles. Why? Well, I foresee a shortage in actual experience coming up in the few years. There’s a dilution of brain cells happening, a huge brain drain - people simply aren’t practicing important skills like programming, and overly relying on LLMs to do it for them. So, in such a world, what’s the most valuable asset? Core skills that allow you to wield these systems more efficiently. The monke stonks shall rise by simply learning, when everyone else’s stonks are falling due to overreliance on LLMs. Why would people pay you if you could just get an LLM to do the same thing? You need to lean into what makes YOU worth hiring. Aim to live a life that compounds with every passing day, not a life that progresses linearly, because in several years that will make all the difference.

Reading List

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (212/400 pages)

    • Founders At Work by Jessica Livingston (112/472 pages)

• Next on the list:

  • Fiction: Mort by Terry Pratchett

  • Non-Fiction: Day Zero to Zero Day by Eugene Lim (SpaceRaccoon)

Resources

• How a "Fixed" IDOR and an Empty String Led to 5 Million+ File Leaks: My friend Hacktus posted a rare blog post on an IDOR he found.

• DOM Clobbering to CSPT gadget: Castilho found a gadget to escalate certain DOM Clobbering situations into CSPT using a URL parsing gadget.

• Introducing Aardvark: OpenAI’s agentic security researcher: OpenAI launched… a hackbot? The effectiveness remains to be seen.

MonkeHacks #81

My new feline alarm clocks, Meap and Tora, pester me awake at 7:15am every morning to be fed. Needless to say, my sleep schedule has magically corrected itself. The first week was incredibly stressful, but both the cats and I have settled into somewhat of a routine now. They sleep for most of the afternoon, so I use that time to have coffee and do some work. As far as kittens go, they’re pretty well-behaved.

Tora is a very photogenic little guy.

Weekly Ideas / Notes 

• It became very apparent to me that I need more space - my flat is about 40-45sqm, and most of that is occupied by the cats. Because of this, I started doing some viewings, and I think I’ll end up flat-sharing with a friend of mine. I did look at more expensive places - but I don’t want lifestyle creep to kick in, so I’m avoiding pricier options. I’m hoping to make that move in November, after the LHE. Lifestyle creep is terrifying, and it can creep up on you so suddenly, I’m just thankful to have friends looking out for me who snapped me out of it.

• Speaking of the LHE… I’ll be taking part in HackerOne’s H1-3120 LHE in Amsterdam! I’m looking forward to meeting my hacker friends there. If you’re going, let me know! :)

• I’ve finally settled into a routine with the cats. I have Loop earplugs (which are amazing, by the way, especially when everything is a bit overwhelming). The cats have forced me into a routine of productivity, and I can no longer hack into the night because they’ll wake me up at 7am anyway.

• On the technical side, I did a small Spot Check on HackerOne this week (the first one I’ve gotten in many, many months… I have no idea how those things work or get distributed). I also gave a virtual talk to UMass Amherst (the university in Massachusetts) and I’m flying to Dublin tomorrow to give a talk to TUD (Dublin’s technical university). My friends are taking care of my cats while I’m away. I decided to apply to YC with my startup project, so I’m writing the application for that at the moment. But all in all, figuring things out with the cats has taken up way too much of my time. Things should settle down a bit in the next few weeks. I hope. The compounding effect of my lack of sleep, with the extra cat tasks, the talks, and the upcoming LHE… it’s definitely taken a toll on me, and I need to find a new rhythm. I feel like an octopus, working on these many projects in parallel and keeping them all ticking along. There’s definitely a little bit of “decision fatigue”. One of the downsides of being self-employed.

Reading List

It was a non-fiction week this week - I read some of Founders at Work. Very good book.

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (180/400 pages)

    • Founders At Work by Jessica Livingston (63/472 pages)

• Next on the list:

  • Fiction: Mort by Terry Pratchett

  • Non-Fiction: Day Zero to Zero Day by Eugene Lim (SpaceRaccoon)

Resources

• F1 Hack: Nagli, Sam Curry and Ian Carroll hacked Formula One, and it went viral. Crazy!

• Why nested deserialization is STILL harmful – Magento RCE (CVE-2025-54236): Assetnote strikes again.

• Scream at It Until It Escalates — XSS to ATO via Server Size Errors Gadgets: My friend Castilho unveiled a new client-side technique - pretty cool!

• Abbreviated Reproduction of CVE-2025-55315 (Critical 9.9 ASP.NET Kestrel HTTP Request and Response Smuggling): Turbo/Demo wrote a neat blog on this CVE.

MonkeHacks #80

Slightly late issue again this week because… I have cats now! Woohoo! More on that below.

It’s been a memorable week for me. Sometimes there are weeks where your life takes a new direction, or your existing lifestyle gets a reshuffle, and this week was one of those. It’s really crazy just how different my apartment feels now, now that there are cats living in it too.

Sometimes I wonder why my life isn’t more peaceful, but after a very short time spent reflecting on it, I realise that it’s entirely my own doing, and I wouldn’t have it any other way. I will be cutting down on my longer trips now that I have pets. I can still do 5-6 day trips, as I have friends who can mind the cats, but longer ones are mostly out of question.

Please welcome Meap (closer) and Tora (further).

Weekly Ideas / Notes 

• Starting with the life stuff - I have cats, at last! I named them Meap and Tora (meap is an alien from the show Phineas and Ferb, and tora means tiger in Japanese; my grandfather was called Torao so this is a kind of tribute to him). They’re 6 months old, so they’re quite mischievous - I haven’t slept very well recently as a result. Having cats has been a longtime goal of mine, and taking care of the two kittens has been incredibly fulfilling so far. It’s actually been a really, really great week - the new Pokémon game was released on the Switch 2, which I was looking forward to for quite a long time, and Joji - formerly known as Filthy Frank - dropped a new single for the first time in 3 years. So all in all - amazing week.

  • I tried to set up a gate to stop the cats from entering my bedroom (it’s quite high up so I’m not going to allow them access until they’re older and more agile) but they jumped over the gate. I put a second gate on top of the first one, this should work better now. I hope they don’t jump it again, because I had to wake up at 6am to put that damn gate up.

• Congratulations gr3pme for becoming a co-host of CTBB! Well deserved, he’s the one writing the Hackernotes for us this whole time.

• I scrapped the startup idea I had before and started a new, much better one. I’m working long hours on the MVP. It’s going very well. I’m looking forward to launching it in the near future. I’m about 50% of the way through the development of the MVP right now.

• I’ll be taking part in HackerOne’s upcoming LHE in Amsterdam at the start of November. More on that closer to the event date! Busfactor is also going! This is my 5th and likely final LHE of the year. I’m very thankful for the opportunity.

• CTBB Episode 144: Busfactor and I are on this week’s episode of the Critical Thinking podcast. Please give it a listen!

• Ireland placed 10th in the European Cybersecurity Challenge! I dropped out of the team because of the Mexico LHE, but I’m really glad to see that they crushed it. 10th of ~34 countries is phenomenal for a country as small and as underfunded as Ireland - it’s a night and day difference from when I first joined the squad around 4 years ago. Funnily enough, as I was returning home from Mexico City, I did run into some of the Kalmar CTF players in the airport lounge - some of whom were heading to Warsaw for ECSC at the time.

Reading List

I haven’t read any books in a while, so I really need to get back to it.

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (180/400 pages)

• Next on the list:

  • Fiction: Mort by Terry Pratchett

  • Non-Fiction: Day Zero to Zero Day by Eugene Lim (SpaceRaccoon)

Resources

• 3 new posts from the CTBB Research Lab: CTBB Labs produced three interesting but brief articles. Check them out!

• Hustle Culture Lied To You: I generally like Matt D’Avella’s videos. In particular, I like this one. In a nutshell: do less, but do the fewer tasks with more intention and focus. And don’t neglect the rest of your life. You will regret it if you only focus on work.

• Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office: Sam Curry and Shubs hacked the World Poker Tournament with a set of surprisingly simple bugs. Absolutely insane.

• CometJacking: How One Click Can Turn Perplexity’s Comet AI Browser Against You: A pretty clever AI bug here. Nice work!

• More Than DoS (Progress Telerik UI for ASP.NET AJAX Unsafe Reflection CVE-2025-3600): This is a VERY technical writeup explaining a .NET gadget in Telerik that the Watchtowr team used to get RCE in Sitecore.

• OpenECSC - kv-messenger: A really nice web challenge involving CRLF that was part of the OpenECSC CTF.

• Finding Critical Bugs in Adobe Experience Manager: Assetnote / SLCyber found several critical bugs in AEM. AEM is everywhere so this is super impressive.