Notes from EAGxOxford 2026
Three days in Oxford talking about frontier risk, fragile funding, warning shots we ignored, and how to actually ship research.
My First Coin & Security Weekly Unlocked!
Notes on the first Security Weekly Unlocked conference, and the first challenge coin I earned.
Python for Penetration Testers: A Review
A review of Udemy's Python for Penetration Testers, and the DVWA login brute-forcer I wrote after it.
Learn Ethical Hacking From A-Z: A Review
Why I cannot recommend Udemy's Learn Ethical Hacking From A-Z, even at a price of zero.
Cisco's Introduction to Cybersecurity: A Review
A review of Cisco's free Introduction to Cybersecurity course, and who it is actually for.
One C2 Implant a Day..
A review of Udemy's Offensive Security Engineering course, and how I extended the custom C2 implant it builds.
Getting this Blog up and Running
Setting up Jekyll with a customised Chirpy theme on GitLab Pages, including the mistakes made on the way.
F[0x05] Reflected XSS in Wordpress plugin - Budyboss
F[0x05]: a reflected XSS in the BuddyBoss WordPress plugin, found while testing a non-profit's platform.
F[0x04] Reflected XSS in Markdown Live Preview
F[0x04]: a reflected XSS in the Markdown Live Preview online editor.
F[0x03] Large Data Leak in KUL CLT platform due to Absent Authentication
F[0x03]: a KU Leuven language institute platform exposed personal data through an endpoint with no authentication at all.
F[0x02] RCE in KUL Education/Examination Platform - E-Systant
F[0x02]: remote code execution in E-Systant, a KU Leuven education and examination platform.
F[0x01] Incident Response for Non-Profit
F[0x01]: incident response on a compromised non-profit website that was redirecting visitors to a fake human-verification page.
F[0x00] Vulnerability Assessment for Non-Profit
F[0x00]: a two-week vulnerability assessment across a non-profit's public-facing assets, and the report it produced.