Attack chain anatomy, methodology deep dives, and security research from the team building Cipher.https://causalsecurity.com/en-ushttps://causalsecurity.com/research/hasura-computed-field-authz-bypass/https://causalsecurity.com/research/hasura-computed-field-authz-bypass/A Hasura computed field returning SETOF a table inherits that table's row permissions on selection, relationships, and aggregations. On one path, a where-clause over the field, the filter is dropped, turning it into a boolean oracle for hidden rows.Mon, 29 Jun 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/stackgres-metrics-exporter-rce/https://causalsecurity.com/research/stackgres-metrics-exporter-rce/StackGres's bundled metrics exporter opens superuser sessions into every tenant database and runs unqualified catalog SQL with no search_path pinning, so a tenant database owner can shadow a function and reach OS command execution in the primary Postgres pod.Fri, 26 Jun 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/supabase-realtime-presence-leak/https://causalsecurity.com/research/supabase-realtime-presence-leak/Supabase Realtime enforces a presence.read policy on the initial presence snapshot but not on the ongoing presence_diff fan-out, so a member allowed to broadcast but denied presence can still read every other member's presence metadata on a private channel.Thu, 25 Jun 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/sevenzip-ext-oob-read/https://causalsecurity.com/research/sevenzip-ext-oob-read/7-Zip parses ext2/3/4 disk images by content. One attacker-controlled superblock field drives the inode-bitmap scan past a fixed-size buffer: a heap out-of-bounds read that crashes the process the moment an untrusted image is listed or extracted.Thu, 25 Jun 2026 00:00:00 GMTdisclosureopen-sourcememory-safetyhttps://causalsecurity.com/research/graphicsmagick-pcd-write-overflow/https://causalsecurity.com/research/graphicsmagick-pcd-write-overflow/GraphicsMagick ported ImageMagick's out-of-bounds read fix for the PCD decoder but not the write-side bound that shipped alongside it, leaving an attacker-controlled heap overflow in DecodeImage: the un-ported other half of the same hardening.Wed, 24 Jun 2026 00:00:00 GMTdisclosureopen-sourcememory-safetyhttps://causalsecurity.com/research/wallet-mint-open-internet/https://causalsecurity.com/research/wallet-mint-open-internet/A consumer fintech asked Cipher to extend a review into its infrastructure. Modeling the wallet's request flow end to end surfaced an internal money-crediting endpoint reachable, unauthenticated, from the open internet (proven with a reverted credit).Mon, 22 Jun 2026 00:00:00 GMTcase-studybusiness-logicpayment-flowshttps://causalsecurity.com/research/zitadel-oauth-client-binding/https://causalsecurity.com/research/zitadel-oauth-client-binding/ZITADEL's OAuth token endpoint authenticated the calling client but never checked that the grant it was redeeming had been issued to that client. The same binding check already existed on the revoke path. One missing invariant, spanning three grant types and token exchange.Wed, 17 Jun 2026 00:00:00 GMTdisclosureopen-sourcebusiness-logichttps://causalsecurity.com/research/vim-security-research/https://causalsecurity.com/research/vim-security-research/Cipher's ongoing security research into Vim: memory-safety bugs in spell-file, soundfolding, text-property, and libsodium-decryption handling, plus command-injection and code-execution flaws in netrw and C omni-completion, all reported upstream and fixed.Tue, 16 Jun 2026 00:00:00 GMTdisclosureopen-sourcememory-safetyhttps://causalsecurity.com/research/open5gs-amf-nas-oob-read/https://causalsecurity.com/research/open5gs-amf-nas-oob-read/Cipher reported a pre-authentication out-of-bounds read in Open5GS, the open-source 5G core. One malformed NAS message reaches the AMF before authentication and crashes it, taking service down for every connected subscriber.Fri, 05 Jun 2026 00:00:00 GMTdisclosurememory-safetyopen-sourcehttps://causalsecurity.com/research/payments-platform-takeover-chain/https://causalsecurity.com/research/payments-platform-takeover-chain/A field report from a cross-border payments engagement. Five findings, each a routine medium on its own, chain from an anonymous Internet request to direct money movement. The work was reading them together.Fri, 08 May 2026 00:00:00 GMTcase-studypayment-flowsbusiness-logic