When the Request Picks the Algorithm: HMAC Downgrade in Symfony's Mailomat Webhook Parser (CVE-2026-48747)
The webhook signature header names its own hash algorithm, so the attacker picks the weakest one. CVE-2026-48747.
Essam Alanazi
Security researcher
Research
Write-ups from vulnerabilities I found and reported.
Escaping Kubernetes Operators: Hardlink Traversal and the ZipSlip Blind Spot
A hardlink inside a tar archive walks out of the extraction directory and overwrites files on the Kubernetes host node.