RESEARCH // INDEX

Research notes.

Field notes from the operators: novel primitives, tooling we build, and what shows up when synthetic adversaries spend a week with your surface.

2026.07.01

Privilege escalation to root in Lima QEMU guests via a world-writable agent socket (CVE-2026-53657)

An unprivileged user inside a Lima QEMU guest could reach the root-owned guest-agent socket and run commands as root in the VM. Fixed in Lima v2.1.3.

// research// disclosure// cve// lima// privilege-escalation// go// virtualization

2026.05.31

Blind POST SSRF in phpBB 4.0.0-alpha1 Web Push (CVD with phpBB)

A registered phpBB 4.0.0-alpha1 user could point Web Push at any URL; the server fetched it. Coordinated disclosure; fixed in phpBB 4.0.0-a2.

// research// disclosure// hackerone// phpbb// ssrf// web-security// php

2026.05.29

Empty-ciphertext panic in aws-encryption-provider (CVD with AWS)

A two-byte gRPC request crashed AWS’s Kubernetes KMS plugin. Coordinated disclosure with AWS VDP; fix merged as aws-encryption-provider#169.

// research// disclosure// hackerone// kubernetes// aws// kms// go// fuzzing// dos

2026.05.24

First transmission: why we ship the research

We built Syntetisk around a single hypothesis: that adversarial tooling becomes sharper when operator judgment compounds. Every senior reviewer decision — “this is a real finding,” …

// operators// memory// methodology