# Raphael's Security Blog

> Blog about random security topics and research.

Security research and write-ups by Raphael Karger (rek7). Recurring topics: offensive security research, vulnerability discovery and CVE analysis, supply-chain and application security, cloud security, red teaming, and Windows persistence and malware tradecraft. Posts are long-form and include proof-of-concept code, command output, and vendor disclosure timelines.

Every post below is also available as a single plain-text file: [/llms-full.txt](https://blog.raphael.karger.is/llms-full.txt).

## Posts

- [Scanning the Scanners: Compromising Five Security Vendors Through Their Own Scanners](https://blog.raphael.karger.is/articles/2026-08/scanning-the-scanners) (2026-08-12): We fed untrusted repositories to 20 hosted code scanners. Five ran our code or read outside the repo, and all five leaked the vendor's own operational credentials. The write-up behind my Black Hat USA 2026 talk.
- [Black Hat USA 2026: Scanning the Scanners (Slides, Deck & Tools)](https://blog.raphael.karger.is/articles/2026-08/bh-2026) (2026-08-06): Slides, tools, and links from my Black Hat USA 2026 briefing on hosted code scanners that execute the untrusted repositories they process.
- [Abusing OS Patch Management in GCP for Lateral Movement and Persistence](https://blog.raphael.karger.is/articles/2022-08/GCP-OS-Patching) (2022-08-11): Using OS patch management in GCP to pivot and maintain access to compute instances.
- [Analysis and Discovery of CVE-2020-13693](https://blog.raphael.karger.is/articles/2020-05/CVE-2020-13693) (2020-05-29): Source code analysis to find privilege-escalation in 300k sites.
- [Context Menu persistence using DLL Hijacking](https://blog.raphael.karger.is/articles/2020-03/context-menu-persistance) (2020-03-18): Using DLL hijacking to gain persistence in explorer.exe.

## Topics

- [malware](https://blog.raphael.karger.is/categories/#malware): 1 post
- [windows](https://blog.raphael.karger.is/categories/#windows): 1 post
- [persistence](https://blog.raphael.karger.is/categories/#persistence): 2 posts
- [CVE Analysis](https://blog.raphael.karger.is/categories/#CVE Analysis): 1 post
- [Source Code Analysis](https://blog.raphael.karger.is/categories/#Source Code Analysis): 1 post
- [Web Exploitation](https://blog.raphael.karger.is/categories/#Web Exploitation): 1 post
- [Wordpress](https://blog.raphael.karger.is/categories/#Wordpress): 1 post
- [Google Cloud Platform (GCP)](https://blog.raphael.karger.is/categories/#Google Cloud Platform (GCP)): 1 post
- [red teaming](https://blog.raphael.karger.is/categories/#red teaming): 1 post
- [cloud security](https://blog.raphael.karger.is/categories/#cloud security): 1 post
- [black hat](https://blog.raphael.karger.is/categories/#black hat): 2 posts
- [supply chain](https://blog.raphael.karger.is/categories/#supply chain): 2 posts
- [application security](https://blog.raphael.karger.is/categories/#application security): 2 posts
- [security research](https://blog.raphael.karger.is/categories/#security research): 2 posts

## Optional

- [Full text of all posts](https://blog.raphael.karger.is/llms-full.txt): every post on this site, complete, as one plain-text file
- [Archive](https://blog.raphael.karger.is/archive/): all posts grouped by year
- [Categories](https://blog.raphael.karger.is/categories/): all posts grouped by topic
- [RSS feed](https://blog.raphael.karger.is/feed.xml): the 10 most recent posts
- [Author site](https://raphael.karger.is/): Raphael Karger's personal site
- [GitHub](https://github.com/rek7): source code and tooling released alongside these posts