Fixed
use-after-free
ICMP6 remote heap use-after-free
A malformed echo request frees the message buffer before the reply path is finished with it, reachable from the network on a Thread border router.
openthread/openthread
PR #13563
offensive security · defensive security
Fabrice K.
I own security end to end where I work — I built the internal penetration testing program from scratch and run the red and blue team work that keeps the infrastructure honest. I don't just write the findings; I'm on the hook for fixing them. Outside the day job I hunt bugs on real targets.
Disclosures
Vulnerabilities I reported and the vendors fixed. Nothing goes on this list until the fix has shipped, so each row links to the public commit that closed it.
Fixed
supply chain
Argument injection in the cherry-picker
Issue text parsed into a commit id kept a leading dash, so an attacker-supplied value reached git as an option rather than an argument.
bazelbuild/continuous-integration
PR #2816
Rewarded
CVSS 8.2 high
Unauthenticated file-scanning API
A management API on a malware-scanning appliance answered unauthenticated callers, exposing scan operations to anyone who could reach it.
Vendor withheld
No public reference
Two further findings are with vendors, pending fix.
Recognition
Acknowledgements that came out of the research rather than a course completion.
MSRC Special Mentions
Listed on Microsoft Security Response Center's special mentions leaderboard for the Microsoft Identity research.
Black Hat USA 2026
Invited to the MSRC Security Researcher Celebration during Black Hat USA week in Las Vegas.
Certifications are verifiable at Credly Accredible Hack The Box
Writing
All 21 posts- CWEE Path Notes — Module 2: Introduction to NoSQL Injection 10 min read
- CWEE Path Notes — Module 1: Injection Attacks 6 min read
- The Floor Just Moved: Project Glasswing, Claude Mythos Preview, and What It Means for the Rest of Us 9 min read
- The 2026 Deep Dive 3 min read
- Certified Cyber Security Engineer [CCSE] Review: Is it Worth it? 6 min read
About
I came at this sideways: an Electronic Engineering background, then customer service, IT support, system administration and IT management before security became the whole job. Somewhere in there I picked up a MicroMasters in Cybersecurity from the Rochester Institute of Technology and a stack of certifications to back the hands-on work.
This site is where the notes go — path write-ups, research, and what the findings actually taught me.
Full background and certifications
blog.redteamshell.com
Fabrice K.
Offensive & defensive security
Red team · Blue team · Bug bounty
Valencia, Spain
Fabrice K.
fabrice@redteamshell.com
blog.redteamshell.com