Agentic Rescue: A Linux Rescue Stick with an Agent Inside
A NixOS rescue ISO with opencode, Claude Code and Codex, plus a configuration slot you can patch in your browser.
The archives.
Code, discoveries, detours. Collected over the years.
2026
A Recycled File Descriptor: CVE-2026-103547 in OpenBSD's ldapd
OpenBSD · ldapd(8) · CVE-2026-103547 · CVSS 4.0 9.2 Critical CVE-2026-103547 is a bug with no memory corruption and no exotic side channel. It is two processes agreeing to identify a client by a number that the operating system is…
The Timestamp Keycloak Forgot to Check: CVE-2026-1190
Keycloak · SAML brokering · CVE-2026-1190 · CVSS 3.1 Low SAML has two places that tell you when an assertion stops being valid. Keycloak, acting as a SAML broker, checked one of them and quietly ignored the other. That is the whole bug.…
Fine-Tuning Qwen3-VL with LoRA: Price Lists to JSON
How to approach Qwen3-VL fine-tuning with LoRA for PDF and image-to-JSON extraction: corrected training data, a TRL example, and price validation.
The Last Bitbender: Reversing Heaven's Gate with Binary Ninja
COMPFEST CTF 2026 · Reverse Engineering chall.exe is a 3,072 byte PE32 that barely does anything on its own. It allocates RWX memory, copies 674 bytes into it and calls the result. That little blob is the actual challenge. It starts in…
Tonight at the Nuremberg Claude Code Meetup: How I Accidentally Became #2 VDP Researcher for Germany on HackerOne
Tonight, April 16th 2026 at 19:20, i’m giving a talk at the Nuremberg Claude Code Meetup. The title: How I Accidentally Became #2 VDP Researcher for Germany on HackerOne Slides are here: no2vdp.bett.ag And yes, the #2 part is real. This…
Open letter to Peter, Kleine Katze, Mogli and Fussel
Dear Peter, Kleine Katze, Mogli and Fussel, I don’t think people really understand what losing each of you did to me. With every one of you that died, something in me got worse. Something got darker. My humor turned another notch…
From Contract Dev to AI-Powered Bug Bounty Hunter: How I Automate the Offensive - 1 Month Update
one month ago, i wrote about pivoting from freelance development to AI-powered bug bounty hunting. i started with “valid duplicates.” here’s where the rig stands today. From Duplicates to CVEsCVE-2026-1190 (KeyCloak) my agents found a…
2025
From Contract Dev to AI-Powered Bug Bounty Hunter: How I Automate the Offensive
Let’s be real for a second. The project market for freelance developers in Germany right now? It’s basically dead. The economy is weird, budgets are frozen, and everyone is sitting on their hands. But i’m not the type to sit around. For…
AI Assisted Coding: Stop whining and learn the tool
Over the last few years, i’ve immersed myself completely in the AI landscape. I’m not just talking about playing with ChatGPT for fun; i’m talking about high-level consulting, training and running my own models in my own racks here in…