Where was Mythos when WordPress fell?
On marketing claims nobody checks, the 1,000 projects Anthropic never listed, and why an industry full of experts followed along.
Research
2026
2020
Jolokia endpoints: JNDI RCE and heap dumps
A full lab build and exploitation walkthrough for exposed Jolokia JMX endpoints: reflected XSS (CVE-2018-1000129), JNDI remote code execution via a rogue LDAP server (CVE-2018-1000130), and dumping the Java heap to recover credentials.
2016
Google Cloud Console: dormant stored XSS
An XSS payload stored as a Google Cloud project name executed months later in the unfiltered project-deletion error message, earning a $5,000 VRP reward, plus the impact argument that got it past a self-XSS classification.
2015
Shopify POS firmware: extracting a root hash
An in-scope Shopify POS endpoint exposed the card reader’s firmware bundles, which unpack via binwalk, a dd carve at 0x202024 and jffs2dump into a JFFS2 root filesystem containing a salted MD5 root hash.
XSS via XML File Upload on PayPal
PayPal’s invoicing feature accepted .xml attachments, and an XHTML-namespaced script element inside the XML executed when the file was served back. Includes the exploitability argument needed to qualify it for a bounty.
2014
PayPal Stored XSS via a Signup Flow Bypass
A stored XSS in PayPal’s account name field, delivered to arbitrary users through invoices after bypassing the signup flow’s security check by truncating the workflow URL to /webapps/.
XSS in Google Tag Manager via JSON Import
Google Tag Manager validated macro names in the web UI but not in the JSON container import path, so a payload smuggled through a file upload executed and earned a $5,000 bounty.
Chrome backslash URLs and XSS filter bypass
Chrome resolves and executes a script URL written as http: followed by any number of backslashes. Firefox does not, and that difference can slip past pattern-matching XSS filters, closed by Chromium as wontfix.
2013
iTunes anti-debugging bypass with GDB and LLDB
Defeating iTunes’ ptrace-based anti-debugging on OS X by breaking on ptrace and rewriting the rdi register, and porting the bypass from Apple’s GDB to LLDB to get a Python-capable debugger.