Latest from Hayrok Security Research
Technical analysis of exploited vulnerabilities, emerging threats, attacker techniques, and defensive opportunities.
PHP2Shell: PHP RCE now exploited and in CISA KEV
Which PHP versions fix it, how to patch and restart, what to do if you cannot patch, and how to check exposure.
Adobe Commerce PolyShell: exploited and now in CISA KEV
Patched is not the same as clean. Four checks to prove your store is safe.
Collabora Online: Nextcloud servers under attack
Attackers are using the flaw to plant web shells on Nextcloud servers. Update, then prove the server is clean.
Oracle EBS: attackers are already probing
Probing began a week after the fix. Patch, then prove nothing is still exposed.
Next.js: is your SVG image path exploitable?
A critical RCE, but only for apps that optimize SVG images on glibc Linux. Upgrade, then prove which apps are exposed.
Exploit chaining is outpacing patching. Here's what to validate this week.
How attackers combine individually moderate flaws into a single path, and the checks that break the chain.
Detection drift is a first-class metric
Rules decay as environments change. Measure detection outcomes, not rule counts.
IAM paths, not IAM findings
Why individual permission findings miss the escalation chains attackers actually use.
Research built for security decisions
A vulnerability alert tells you that a weakness exists. Security teams need to know whether it can be exploited, how an attacker could use it, and what action will reduce the risk.
Hayrok Security Research connects technical findings to the decisions defenders must make.
Three research tracks
Every conclusion shows its basis
Every Hayrok Security Research publication is designed to make the basis of its conclusions clear. Findings carry one of four labels, so observation is never confused with inference.
We document relevant assumptions, prerequisites, sources, and limitations so readers can judge how the findings apply to their own environments.
Explore Hayrok
See how Hayrok helps security teams run governed adversarial exposure validation and produce replayable evidence of security risk.