// research archive
Case studies show the affected boundary, root cause, validation method, practical impact, disclosure status, and remediation. Working exploit material stays out of the public record until coordinated disclosure is complete.
Published research
Three published vulnerabilities affected GSDX signature verification, signed plug-in deployment, and extraction paths. CERT@VDE credits Ievgen Bondarenko; Phoenix Contact fixed the issues in PLCnext Engineer 2026.6.
Read case studyTwo published vulnerabilities in Moxa AIG-302 firmware affected authorization for a secrets API and protection of a shared Root CA private key. Moxa and CISA credited the reporting researcher.
Read case studyTwo vulnerabilities in the Lantronix G520 update and package-handling mechanisms could allow arbitrary code execution under the conditions described by CISA. The disclosure resulted in two CVEs, a public CISA ICS advisory, and vendor remediation.
Read case studyA Critical SSRF flaw let an unauthenticated caller cross the MLflow server network boundary through webhook redirects and DNS rebinding.
Read case studyA flaw in the agent-side Control Interface authorizer allowed a scoped workload to access or modify cluster state outside its authorized subtree.
Read case studyA model-specific multimodal processor bypassed centralized media-retrieval protections, exposing network and local-file trust boundaries.
Read case studyLMDeploy enabled Hugging Face remote code by default during model loading, removing the operator decision that peer inference systems expose as an explicit opt-in.
Read case studyResearcher-reported work
These summaries identify work reported by the researcher when no matching public vendor acknowledgement or technical advisory could be verified. They do not claim a public CVE, vendor-confirmed impact, or independently verified upstream fix.
Researcher-reported work examined how application-controlled provider configuration crosses into an AI SDK transport boundary.
Read qualified summaryResearch domains
Model serving, inference systems, AI SDKs, agents, remote resources, model loading, cloud integrations, and isolation boundaries.
Workload orchestration, distributed control, authorization boundaries, messaging infrastructure, robotics middleware, and component-to-component trust.
Embedded and connected devices, industrial software, firmware, device-management tools, network services, management interfaces, certificate validation, device communication, edge infrastructure, and supporting protocols.
Security-sensitive libraries, container systems, parsers, protocols, package handling, cryptographic validation, and other upstream infrastructure.
IoT & Industrial Research
Current work examines security boundaries in connected and industrial systems, including management applications, firmware, embedded software, network-facing services, certificate validation, device protocols, and cloud-connected edge components.
Published industrial research includes 7 vulnerabilities across Phoenix Contact PLCnext Engineer, Moxa AIG-302, and Lantronix G520. Researcher credit and vendor-fixed releases are documented in VDE-2026-121, ICSA-26-293-03, ICSA-26-272-01.
Publicly documented findings are grouped in the published archive. Researcher-reported work without a matching public advisory is labelled separately, and findings still under vendor or coordinator review remain private until disclosure is complete.