Design Partner Program
HAYROK SECURITY RESEARCH

Vulnerability & Threat Intelligence

Know what attackers can exploit, and what to do next.

Hayrok Security Research publishes technical threat intelligence and exploited vulnerability analysis for security teams. We examine how vulnerabilities become attack paths, the conditions that make exploitation possible, and the evidence defenders need to investigate, prioritize, and respond.

One email per publication. Unsubscribe anytime.Validate your exposure →

Latest from Hayrok Security Research

Technical analysis of exploited vulnerabilities, emerging threats, attacker techniques, and defensive opportunities.

FEATUREDExploited VulnerabilitiesOct 28, 2026 · 14 min

Brotli2Shell and ShadowForge: root cause, reachability, and how to prove you are no longer exposed

A decoder bug compiled into half your runtimes, and a PodSpec API that hands the caller your node. Both defeat version-based inventory.

Read the analysis →Check if you're exposed
CVEsCVE-2026-111497 · CVE-2026-65162
CVSS9.2 Critical10.0 Critical
EvidenceObserved exploitation attempt
Includeskubectl · jq · PSA dry-run
EXPLOITED VULNERABILITIESCritical
CVE-2026-109618 · CVE-2026-109619
Observed

PHP2Shell: PHP RCE now exploited and in CISA KEV

Which PHP versions fix it, how to patch and restart, what to do if you cannot patch, and how to check exposure.

Oct 28, 2026 · 9 minRead →
EXPLOITED VULNERABILITIESCritical
CVE-2026-48356
Observed

Adobe Commerce PolyShell: exploited and now in CISA KEV

Patched is not the same as clean. Four checks to prove your store is safe.

Oct 28, 2026 · 7 minRead →
EXPLOITED VULNERABILITIESHigh
CVE-2026-110447
Observed

Collabora Online: Nextcloud servers under attack

Attackers are using the flaw to plant web shells on Nextcloud servers. Update, then prove the server is clean.

Oct 28, 2026 · 7 minRead →
THREAT INTELLIGENCEHigh
CVE-2026-101767
Observed

Oracle EBS: attackers are already probing

Probing began a week after the fix. Patch, then prove nothing is still exposed.

Oct 28, 2026 · 6 minRead →
ATTACK TECHNIQUESCritical
CVE-2026-96889
Assessed

Next.js: is your SVG image path exploitable?

A critical RCE, but only for apps that optimize SVG images on glibc Linux. Upgrade, then prove which apps are exposed.

Oct 28, 2026 · 8 minRead →
THREAT INTELLIGENCEHigh
Multi-CVE
Assessed

Exploit chaining is outpacing patching. Here's what to validate this week.

How attackers combine individually moderate flaws into a single path, and the checks that break the chain.

Oct 7, 2026 · 6 minRead →
DETECTION & DEFENSEMedium
Detection engineering
Assessed

Detection drift is a first-class metric

Rules decay as environments change. Measure detection outcomes, not rule counts.

Sep 2026 · 6 minRead →
ATTACK TECHNIQUESHigh
Identity
Assessed

IAM paths, not IAM findings

Why individual permission findings miss the escalation chains attackers actually use.

Sep 2026 · 7 minRead →
FROM RESEARCH TO PROOF
Patched is not the same as safe. Prove these paths are closed in your environment.
Hayrok validates the attack paths in this research against your systems and returns replayable evidence of what is still exploitable.
BUILT FOR DECISIONS

Research built for security decisions

A vulnerability alert tells you that a weakness exists. Security teams need to know whether it can be exploited, how an attacker could use it, and what action will reduce the risk.

Hayrok Security Research connects technical findings to the decisions defenders must make.

01What is happening?CONTEXT
02How does the attack work?MECHANICS
03Which systems and conditions are affected?SCOPE
04What evidence indicates exploitation?EVIDENCE
05How can defenders detect or investigate it?DETECTION
06Which mitigations reduce the exposure?MITIGATION
07How can remediation be validated?VALIDATION
WHAT WE PUBLISH

Three research tracks

Understand the vulnerability beyond its severity score.

Our vulnerability research examines the technical conditions that turn a disclosed weakness into an exploitable path.

Explore exploited vulnerabilities →
EACH ANALYSIS MAY INCLUDE
Root cause and affected components
Exploitation prerequisites
Vulnerable configurations
Authentication and access requirements
Privilege and trust boundaries
Potential attack paths
Indicators of exploitation
Detection opportunities
Mitigation and remediation guidance
Validation considerations
FROM CVE TO ATTACK PATH

A vulnerability rarely creates risk in isolation

Exploitation depends on the surrounding environment: access, configuration, identity, reachability, trust, privileges, and defensive controls.

Hayrok Security Research examines these relationships to show how a vulnerability could become part of a larger attack path, and where defenders can interrupt it.

STAGE 01 · VULNERABILITY
Root cause, affected component, and weakness class, stated precisely enough to reproduce.
IN THE RESEARCH
Brotli2Shell · CWE-787 in c/dec/decode.c, libbrotlidec 1.0.3 – 1.2.0
See this path traced, end to end, in your own environment.Map my attack paths →
EVIDENCE FIRST

Every conclusion shows its basis

Every Hayrok Security Research publication is designed to make the basis of its conclusions clear. Findings carry one of four labels, so observation is never confused with inference.

We document relevant assumptions, prerequisites, sources, and limitations so readers can judge how the findings apply to their own environments.

OBSERVED
Behavior or activity supported by direct evidence.Direct telemetry, KEV listing, or captured activity
REPRODUCED
Behavior validated under controlled conditions.Lab reproduction under an approved scope
ASSESSED
A conclusion derived from the available technical evidence.Analyst inference from code, advisories, and configuration
THEORETICAL
A technically plausible path that has not been observed or reproduced.Plausible, flagged as unconfirmed
Confidencehighest → lowest
ABOUT HAYROK SECURITY RESEARCH

Hayrok Security Research investigates vulnerabilities, adversary behavior, and the conditions that turn exposure into compromise.

Our work helps security teams move from vulnerability awareness to evidence-based action: understanding what matters, why it matters, and how to validate that the risk has been reduced.

Get new research from Hayrok

Receive technical analysis of exploited vulnerabilities, emerging threats, attacker techniques, and defensive opportunities from the Hayrok Security Research team.

By subscribing, you agree to receive research and security updates from Hayrok. You can unsubscribe at any time.

Explore Hayrok

See how Hayrok helps security teams run governed adversarial exposure validation and produce replayable evidence of security risk.