Hey, I’m Patrik, a security researcher from Germany. I work at Assetnote, a Searchlight Cyber company, researching pre-auth vulnerabilities in widely deployed software.
For consulting and penetration testing, you can reach me through threatover.
I published as Patrik Fehrenbach until 2025, so most of the older writeups and the press below are filed under that name.
What I work on#
Right now that is mostly pre-auth bugs in software that is deployed everywhere. This year that has meant an anonymous SQL injection in Drupal core (CVE-2026-9082) and a pre-auth arbitrary file read as root in cPanel (CVE-2026-29205).
Outside of that I build AI agents and wire them into real workflows. h1-brain is an MCP server I wrote that gives Claude my HackerOne bounty history and a database of public disclosures so it can brief me on a programme before I start. I write about that side of things here too.
Projects#
Research tooling
h1-brain
An MCP server that turns your HackerOne report history and public disclosures into a starting point for your next bug bounty hunt.
For bug bounty researchers using AI assistants.
Vulnerability intelligence
RD Intelligence
A platform that brings together vulnerability disclosures, exploit activity, and threat context to help teams decide what to investigate first.
For security teams prioritising vulnerabilities.
Security consulting
threatover
My security consulting practice, covering penetration testing, security advisory, bug bounty programmes, and vulnerability triage.
For teams that need hands-on security support.
Where I’ve worked#
I’ve been hunting bugs since 2012, from independent bug bounty work to triage, security engineering, and threat research.
Selected research#
- Keys to the Kingdom: anonymous SQL injection in Drupal core (CVE-2026-9082, 2026)
- New Age of Collisions: pre-auth arbitrary file read as root in cPanel (CVE-2026-29205, 2026)
- h1-brain, an MCP server that gives Claude your HackerOne history (2026)
- Exploiting Jolokia: XSS, JNDI RCE and heap dumps ($33,500 across multiple targets)
- Extracting a root hash from Shopify POS firmware
- A dormant stored XSS in the Google Cloud Console ($5,000, Google VRP)
- Stored XSS and a flow-state bypass at PayPal
Browse the complete research index or pick a topic. The older writeups also have their own archive.
Talks#
- NahamCon 2021 · A Massive Leap in Host Discovery · video
- Troopers 2016 · Security Evaluation of Dual-Stack Systems · slides · video
Publications#
- SQL Injection Lücken finden · Admin Magazin (German)
- Discovering SQL Injection Vulnerabilities · Admin Magazine (English)
Press#
- Bayerischer Rundfunk, PULS, Die Frage · Muss ich Angst vor Hackern haben? · video
- heise Security · Viele Finanzämter mit unsicheren Websites (German)
- heise Security · l+f: PayPal kämpft mit XSS-Problemen (German)
- Web Hacking 101 Pro Tips #2 · video
Elsewhere#
Searchlight Cyber for current research · rdintel.com · threatover.com · LinkedIn · GitHub · Bugcrowd