Scope the system
Identify assets, actors, attack surfaces, trust assumptions, and the security question being tested.
Landing
Independent Application Security Research
Security research that starts in the code.
I’m Duy Tran, an application security researcher focused on source-code review, authorization boundaries, web/API security, and practical vulnerability validation. I work through authorized testing and coordinated disclosure.
Research
Public evidence, not marketing claims.
My research archive documents public vulnerability disclosures, CVE write-ups, technical validation, and the reasoning behind security findings.
Method
Evidence-driven review from boundary to impact.
Trace boundaries
Follow attacker-controlled data through authentication, authorization, persistence, and sensitive sinks.
Validate behavior
Use controlled runtime testing and negative controls to distinguish reachable impact from suspicious code.
Deliver evidence
Document reproducible findings, affected boundaries, impact, and remediation guidance without unsupported claims.
Newsfeed
Latest research, write-ups, and notes.
The original blog feed stays here as the living stream of new research and learning posts.
PHP2Shell: The 14-Year-Old PHP Bug That Just Went Mass-Exploit
PHP2Shell (CVE-2026-109618/619): critical PHP RCE, CVSS 9.2, affecting PHP 5.4 to 8.5.11. Root causes, fake PoCs, exposure checks, detection, and patching.
Read postCVE-2026-104751: Rank Math SEO Unauthenticated SEO Analyzer Results Deletion
Source-level analysis and local runtime validation of unauthenticated SEO Analyzer cache deletion in Rank Math SEO versions before 1.0.280.
Read postCVE-2026-86827: BackWPup Unauthenticated Backup Job Execution via WP-Cron
A missing authorization boundary in BackWPup cronrun allowed unauthenticated requests to start existing backup jobs. Includes source analysis, local runtime validation and a negative cont...
Read postHow Patchstack Is Devaluing Vulnerability Research
A researcher-side critique of Patchstack's shared bounty pool, duplicate risk, XP dilution, rejection penalties, leaderboard incentives, and the economics of vulnerability research.
Read postThe Security Bugs I Look for First When Reviewing a Codebase
When I review an unfamiliar codebase, I prioritize broken authorization, trust-boundary failures, alternate interfaces, sensitive state transitions, and data-lifecycle mistakes before cha...
Read postCVE-2026-16612: FiboSearch Autocomplete Exposed Password-Protected Products
FiboSearch exposed password-protected WooCommerce products through autocomplete search responses when the request came from a logged-in Subscriber session that had not entered the product...
Read postCVE-2026-15231: TaxoPress AI Preview Leaked Private Post-Derived Output
TaxoPress before 3.51.0 allowed Contributor-level users to reference private posts in the AI Preview workflow and receive output derived from posts they were not authorized to read.
Read postCVE-2026-15248: Meta Box Contributor+ Arbitrary Attachment Deletion
Meta Box versions before 5.13.1 allowed authenticated users with access to a file-field workflow to delete attachments belonging to other users because the deletion endpoint trusted reque...
Read post