Research desk

Reproducible findings, not hot takes

Technical reporting for reverse engineering, cloud security labs, vulnerability analysis, and defensive testing.

ThreatFrontier poster showing Claude Code internals as a local agent runtime with tools permissions sessions and SDK

How Claude Code Works Internally: From CLI Startup to Agentic Tool Execution

A practical systems-level explanation of Claude Code as a local agent runtime, covering startup, authentication, tools, permissions, sessions, MCP, plugins, and the Agent SDK.

ThreatFrontier poster showing Langflow CVE-2026-33017 public workflow build endpoint remote code execution

AI Gateway Security AI Security

Critical Langflow Vulnerability Exposes AI Workflows and API Keys to Active Exploitation

CVE-2026-33017 exposes Langflow AI workflow builders to unauthenticated remote code execution through the public flow build endpoint.

ThreatFrontier poster showing Trivy CVE-2026-33634 supply chain compromise in CI/CD pipelines

Supply Chain Supply Chain

Trivy Vulnerability Turns Trusted CI/CD Scanner Into Supply Chain Secret-Stealing Threat

CVE-2026-33634 turned trusted Trivy releases and GitHub Actions into credential-stealing malware inside CI/CD pipelines and developer environments.

ThreatFrontier poster showing the SimpleHelp three-flaw attack chain against MSP remote support infrastructure

Exploited Vulnerability Exploits

Three Flaws, One Attack Chain: How SimpleHelp Became Ransomware's Favourite MSP Gateway

SimpleHelp CVE-2024-57727, CVE-2024-57726, and CVE-2024-57728 form an attack chain abused by ransomware actors against MSPs and downstream customers.