07
Research
Why CVE Counts Are Wrong
Counting vulnerabilities is not the same as measuring risk. A reachability-first view of a real image, with the graph evidence to back it.
Emphere Engineering
Field notes from
engineering and security
How we keep a security product honest: deterministic fixtures, seeded regressions, kernel-level runners, and the evidence behind every claim. No fluff, just what we built and what it caught.
Latest
CVE-2026-42533: nginx map regex heap buffer overflow
CVE-2026-42533: a pre-auth heap buffer overflow in nginx's HTTP script engine. We reproduced the crash on 1.31.2 and verified the 1.31.3 fix end to end.
FULLverification fidelity4001ASan write size145script-engine-adjacent tests passed
Read the postMore writing
02
Security
CVE-2026-50006: unauthenticated arbitrary file write in anyquery server mode
CVE-2026-50006 turns SQLite ATTACH DATABASE into an unauthenticated file-write primitive in anyquery server mode. We reproduced it and verified the 0.4.5 fix.
03
Security
CVE-2026-63030 and CVE-2026-60137: schema-validation bypass reaches an unauthenticated SQL injection in WordPress core
WordPress 7.0.2 fixes a batch REST index-misalignment bug that let a raw string skip schema coercion and reach an unauthenticated SQL injection sink in WP_Query.
04
Security
CVE-2026-63087: unauthenticated admin takeover via Grafana OnCall's v2 install endpoint
Grafana OnCall's v2 install endpoint ships with auth off, minting a plugin token to any anonymous caller; a second flaw grants Admin. We verified the fix.
05
Engineering
Groundzero: Building an Isolated Kernel and Exploit Lab
Groundzero is Emphere's research lab for automated security validation: real kernels, sandboxed exploit ranges, preserved artifacts, and agentic loops that make testing, exploitation, and remediation more exact over time. This is the story of building it, including the parts that broke.
06
Engineering
Testing a Security Tool Like It Can Hurt People
A security tool cannot be tested like a normal CLI. We built a standing assurance platform around deterministic fixtures, real-kernel runners, preserved artifacts, and red runs that prove the system can fail loudly.
On the workbench
Researching
08
Engineering
Determinism by Design: Pinning the Vulnerability Feed
If the feed moves under you, your results are not reproducible. How we pin the database so repeated runs produce identical, provable output.
09
Exploitability
From Exploit to Confirmation: Vulnerable, Patched, Exercised
Matched fixtures that prove a finding is real, not theoretical, by exercising the path on a vulnerable build and confirming the patch closes it.
10
AI
Agents That Read Evidence But Never Mint Truth
An AI evaluator that reads deterministic reports and cites them — and the hard line that keeps a probabilistic system from ever becoming the oracle.
These are in progress and publish only when there is a real artifact behind them. That is the whole point.