The long versions. CVE research, red team notes, and the occasional postmortem of a bug that turned out to be me.
Three months of static analysis for a pre-auth RCE. The vendor's advisory called it a stability improvement.
A study in userland unhooking, and a reminder that trusted process is doing a lot of work in that sentence.
An Active Directory chain that is somehow still your problem in 2026.
Anti-analysis tricks, a packer with self-esteem issues, and one very smug string in the .rdata section.
A short one about trusting a size you did not compute yourself. Spoiler: don't.
Two requests, one balance check, and a coupon system that briefly funded my coffee habit (in staging, relax).