Hey, I’m Patrik, a security researcher from Germany with over a decade in the field. I’ve gone from independent bug bounty hunting to managing triage teams at HackerOne, to security engineering at Shopify and threat research at Recorded Future. These days I’m a Security Researcher at Assetnote, a Searchlight Cyber company, focused on threat detection and vulnerability management.
I published as Patrik Fehrenbach until 2025, so most of the older writeups and the press below are filed under that name.
What I work on#
Right now that is mostly pre-auth bugs in software that is deployed everywhere. This year that has meant an anonymous SQL injection in Drupal core (CVE-2026-9082) and a pre-auth arbitrary file read as root in cPanel (CVE-2026-29205).
Outside of that I build AI agents and wire them into real workflows. h1-brain is an MCP server I wrote that gives Claude my HackerOne bounty history and a database of public disclosures so it can brief me on a programme before I start. I write about that side of things on clawd.it.
Where I’ve worked#
Selected research#
- Keys to the Kingdom: anonymous SQL injection in Drupal core (CVE-2026-9082, 2026)
- New Age of Collisions: pre-auth arbitrary file read as root in cPanel (CVE-2026-29205, 2026)
- h1-brain, an MCP server that gives Claude your HackerOne history (2026)
- Exploiting Jolokia: XSS, JNDI RCE and heap dumps ($33,500 across multiple targets)
- Extracting a root hash from Shopify POS firmware
- A dormant stored XSS in the Google Cloud Console ($5,000, Google VRP)
- Stored XSS and a flow-state bypass at PayPal
Everything else is under research, and the older writeups live in the archive.
Talks#
- NahamCon 2021 · A Massive Leap in Host Discovery · video
- Troopers 2016 · Security Evaluation of Dual-Stack Systems · slides · video
Publications#
- SQL Injection Lücken finden · Admin Magazin (German)
- Discovering SQL Injection Vulnerabilities · Admin Magazine (English)
Press#
- Bayerischer Rundfunk, PULS, Die Frage · Muss ich Angst vor Hackern haben? · video
- heise Security · Viele Finanzämter mit unsicheren Websites (German)
- heise Security · l+f: PayPal kämpft mit XSS-Problemen (German)
- Web Hacking 101 Pro Tips #2 · video
Elsewhere#
Searchlight Cyber for current research · clawd.it for AI and offensive security · rdintel.com · threatover.com · LinkedIn · GitHub · Bugcrowd