Vulnerability Research

Representative Foreword

After the Code, the Structure Remains

The representative foreword of this blog: security now fails less at finding issues than at absorbing, sustaining, and acting on what has already been found.

This essay frames the entire site first. The posts on technical analysis, method, and governance all start from this same problem statement.

Read the Foreword About This Blog

Detection, Method, Governance

🔥 A Mind That Dissects Systems

The O’Reilly Curse: When 20-Year-Old Java Upload Code Becomes a Vulnerability

A documented save-before-validation design in O’Reilly COS MultipartRequest, combined with first-file-only application validation, can leave an executable JSP behind in an image-upload flow. A CWE-434 case study through code, a reproduction walkthrough, and the proper fix.

A Decade of PHP Memory-Safety Bugs: Why Do the Same Failures Keep Returning?

A technical retrospective on a decade of PHP memory-safety research, crediting original discoverers and maintainers while examining failure atomicity, re-entrancy, bailout recovery, and cross-request ownership.

Re-reading the ARTEX Attacks on Korea's Financial Sector: AI Agents, Disposable VPS Infrastructure, and Non-Customer-Facing Systems

A detailed analysis of the ARTEX-linked attacks on Korea's financial sector using public reporting, Shodan/Censys exposure data, anonymous-vps cross-checks, and observed IoCs. The focus is not just the AI tool itself, but disposable infrastructure, non-customer-facing business systems, LLM credential theft, and the defensive changes likely to follow.

You Cannot Assess the Security of External SDKs by Checking Cryptographic Algorithms Alone

Algorithm names like AES-256 or TLS reveal nothing about how keys are generated, who controls the endpoint, or whether a response binds to the real transaction. A broader, evidence-based assessment model for external SDKs and native binaries.

Finding Vulnerabilities Is Not the Same as Building Attack Scenarios

A practical method for modeling vulnerabilities as attacker-relevant security state transitions and combining human intuition with bounded AI search

AI Package and Container Registry Boundaries: Egress Control Architecture for AI Runtimes

Package and container registry proxies are active trust boundaries for AI runtimes. This report turns incident evidence, public SSRF history, and runtime observations into an artifact egress control architecture.

Cryptography Guide for Practical Security Professionals

In practical cryptography, failures often occur in the design—combining randomness, key management, operating modes, error handling, and authentication—rather than in the algorithms themselves. This post outlines criteria for auditing cryptographic implementations from the perspective of security assessors and reversers.

Security Controls Aren't Lacking — They're Inconvenient: Why Security Needs Customer Context

Security controls already exist. The real problem is that we cannot decide which customer, at which moment, deserves how much friction. As the closing chapter of the CAPTCHA·ATO series, this post is about moving from quantity of controls to context of controls — adaptive security as an operational discipline.

The AI Slop Paradox: Why Triage Gets Harder When Vulnerabilities Get Easier to Find

AI lowers the cost of finding vulnerability candidates, but it also increases low-quality reports, duplicates, and false positives. In the AI slop era, triage quality becomes the core security operation.

Beyond CVE Response: AI-Era Vulnerabilities Move Before They Get Numbers

AI-era vulnerability response cannot wait for a CVE number. Pre-CVE signals such as issues, commits, PoCs, write-ups, and patch traces now have to be mapped against internal exposure earlier.

Why Account Takeover Never Ends — Dismantling the ATO Supply Chain

How Korea's CaaS supply chain reproduces itself through the recycling loop of points, gift cards, and crypto — and why defending against it requires reading the entire behavioral network, not just the login page.

Structure Builders Will Outlast Vulnerability Finders

18 years of vulnerability hunting distilled into one insight: the shift from individual instinct to scalable structure — and what AI means for those left standing.

The CAPTCHA That Became a Free Automatic Door for Hackers — A Bypass PoC and Defense Strategy

A practical look at an audio CAPTCHA bypass PoC built with Playwright, Whisper, and Page-Agent, plus the login defenses that still matter after CAPTCHA falls.

WAF/IPS/IDS Detection Gap Analysis and Remediation Direction

Structural analysis of WAF, IPS, and IDS detection gaps from parsing discrepancies, with a practical remediation taxonomy.

The Gap Between CISO Strategy and Execution: The WAF Debate and Field Leadership Report

A comprehensive report presenting a roadmap for practical security improvement and field leadership, centered around the debate on WAF and the gap between philosophy and execution.

Endpoint Security Evasion (2020–2025): From EDR Bypass to EDR Kill

A technical analysis of how BYOI, BYOVD, DLL hijacking, and service abuse shifted endpoint attacks from EDR bypass to EDR kill between 2020 and 2025.

SPOF in Cybersecurity: From History to Strategy, a Graph-Based Analysis

Graph-based analysis of Single Points of Failure in cybersecurity, using weighted path enumeration to identify critical infrastructure nodes.

Detection Frameworks and Latest Methodologies for eBPF-Based Backdoors

How eBPF-based backdoors evade traditional detection, and modern frameworks like Tracee and LKRG that counter kernel-level threats.

In-Depth Report on Telecommunication Security: SKT Breach and Global Case Studies

In-depth analysis of the 2025 SKT breach, telecom authentication mechanisms, and 5G SA vs NSA security architecture differences.

🔥 Trust and Culture Beyond Technology

Before Blaming AI False Positives: The Security Debt of Generalist-Led Organizations

A Korean financial-sector AI code-analysis test reported 40–60% false positives. The deeper question is how technical expertise, validation workflows, budgets, and decision rights shape actual security outcomes.

Why Are the Costs and Risks of Cybersecurity So Widely Distributed Across the Private Sector?

Starting from the debate over criminal liability for CISOs, this post traces Internet commercialization, information asymmetry, responsibilization, security externalities, CVD, NIS2, the CRA, and Korea's 2026 reforms to ask how cybersecurity responsibility has been distributed—and why it is now being rebalanced.

Does Hiring the World's Best Hackers Improve Security?

Bringing world-class hackers and a CTF research ecosystem into an organization can make it stronger, but real security improvement requires turning offensive capability into governance and structural change.

A Critical Reading of Structural Ethics in Cybersecurity Policy: Korea's 2025 Whole-of-Government Information Protection Plan

A reading of Korea's 2025 whole-of-government information protection plan through the structural parallel between the Nightingale myth and the white-hacker discourse. Policy is moving from dependence on individual ethics toward structural accountability, but the transition is not complete.

The Moment AI Truly Becomes New: Not When It Finds the Answer, but When It Rewrites the Problem

Through the Nightingale myth, the white-hacker discourse, the Sterbenz lemma, and browser exploit reasoning, this essay argues that the real change LLMs bring lies not in knowledge retrieval but in problem reframing.

The Real Battleground of National AI Strategy Is Not Just GPU Count

The decisive front in national AI strategy is not GPU count alone, but who controls and can prove the flow of data, models, agents, permissions, logs, and verification running on top of those GPUs.

Supply Chain Security Does Not End with SBOM: Governing AI Development Tools and Automation Connections

AI IDEs, MCP, and automation connectors are not merely developer convenience tools. They are supply-chain assets that affect the trust path of how code is written, reviewed, and shipped.

Why Security Knowledge Transfer Fails — and What to Design Instead

An organizational design report that reframes the security–DevOps problem from failed knowledge transfer to default design, interfaces, exception handling, and alignment.

Contracts vs Security Governance — Contracts Enforce. Governance Decides.

Why security governance must drive decisions before contracts enforce them—a structural reframing for security leadership.

eIDAS 2.0 vs. Korea’s Digital Identity System: A Comparative Analysis

Comparative analysis of EU eIDAS 2.0 wallet-based identity and Korea's mobile ID system across governance, privacy, and operations.

The Visibility Principle: How Internal Vulnerability Visibility Shapes Remediation Behavior

How transparent internal vulnerability visibility drives remediation through accountability and deterrence without formal punishment.

Attack Surface Management in 2025: Why Continuous Visibility is Essential

Why continuous attack surface management is critical in 2025, covering AI-driven discovery, shadow IT, and zero trust integration.

Is Your Data in the Cat's Paws?

Analysis of the 2025 KakaoPay breach exposing 40M users' data, and why formal consent fails without AI-based DPIA and civic oversight.

There’s No Such Thing as a Free Lunch, But Security Was Free

The CVE system nearly collapsed in 2025. Who should fund public cybersecurity infrastructure when free-riding is no longer sustainable?

Common Security Myths Developers Tell Themselves

Debunking developer security myths around responsibility deflection, tech overconfidence, and risk underestimation with real-world examples.

Common Misconceptions of Security Assessors

Three common misconceptions that weaken security assessments and strategies to build repeatable, effective vulnerability evaluation.

🔥 Code That Fixes, Not Just Runs

Race Condition (TOCTOU) Remediation: What Actually Worked in a Real Stack

The same check-then-act race keeps appearing across services: purchase-limit bypass, one draw used by many requests, duplicate coupon cancellation, daily-reward overruns. I built a real stack (nginx + Tomcat×2 + shared Postgres + Redis) and measured which fix actually holds. Most of them need no Redis lock — just a DB conditional UPDATE and an affected-rows check.

Leak and Stage-2 Over One Socket: Reverse Single-Socket Staging

A malicious server corrupting a client that dials out to it, carrying both the libc leak and the second stage over one already-open socket in a single ROP chain. And why this is not a new pattern but a well-known composition.

From a Security Development Spec for Small LLMs to Regression Tests and Fuzzing Validation

This article explains how I split an XSS security development specification for small local models into core/verify/dev/test overlays, and what I learned while connecting LLM-based judgment to regression-test generation and Jazzer/Jazzer.js fuzzing seeds.

An Audit Workflow Survives Only When It Absorbs Misses — Eight Reinforcements to sec-audit-static v2.0

I designed sec-audit-static workflow v2.0, ran it against a real auth-server codebase, and missed two things. This is the record of how those misses were folded back into the tool — through v2.8.

MCP Is Repeating the History of RPC Security

MCP security risks are not about prompt injection. They stem from the same configuration-to-execution escalation pattern that has plagued RPC, local security software, and CI/CD pipelines for decades.

Security Assessment Becomes a Development Process, Not an Outsourced Event

AI-era security assessment is not primarily about reducing outsourcing cost. It is about embedding repeatable verification into the development process while separating automation candidates from human judgment.

How I Turned 228 Endpoints into 5 Clusters

A practical account of applying dataflow-based clustering to a real codebase — reducing 228 endpoints to 5 reviewable clusters, and finding an RCE chain in the cross-section.

Security Diagnostics Reports Die Upon Publication

We point out the limitations of traditional security diagnostic reports and share the necessity and practical application cases of 'Security Testing as Code', managing diagnostic results not as 'documents' but as 'executable code (PoC)'.

How I Managed Unmaintained Open Source with Gmail and Snyk Alerts

Automating Snyk vulnerability alert management with Google Apps Script and Gmail when official API access falls short.

How to Block ECH and Mitigate DoH in Enterprise Networks

A hands-on guide using dnsmasq to filter SVCB and HTTPS records for disabling ECH and enforcing central DNS policies. Notes that DoH requires separate network-layer policies.

The O'Reilly Curse infographic — how O'Reilly COS MultipartRequest's save-before-validation and first-file-only validation can leave an executable JSP behind in an image-upload flow