Sedric Louissaint · Blog

One Exported Service, Six Free Rides: How I Found CVE-2026-12960 in the ASUS Router App

Sedric Louissaint — Sat, 25 Jul 2026 00:00:00 GMT

I went looking for something clever in the ASUS Router Android app and instead found a service sitting wide open with a sign on it. Here is the whole story: the manifest, the Parcelable, the six payloads, and the wait for a fix.

Released Is Not the Same as Accessible: Why I Built a Searchable Archive of the Epstein Files

Sedric Louissaint — Mon, 01 Jun 2026 00:00:00 GMT

Millions of pages are public, and almost nobody can actually search them. That gap is why I built EpsteinFTA.com, a public archive for justice, transparency, and accountability.

The Stryker Incident Is a Warning: Every Organization Must Plan for Nation-State Adversaries

Sedric Louissaint — Mon, 06 Apr 2026 00:00:00 GMT

A cyber incident stopped Stryker's order processing, manufacturing, and shipping, and delayed some surgeries, without ever touching a medical device. Most organizations still plan for commodity ransomware. This is the other threat model.

The Axios npm Supply Chain Attack Is a Warning Shot for the Entire JavaScript Ecosystem

Sedric Louissaint — Sat, 04 Apr 2026 00:00:00 GMT

Two malicious versions of Axios reached npm through a compromised maintainer account, each carrying a dependency whose only job was to drop a remote access trojan at install time. The target was never your users. It was your build machine.

When an Algorithm Can Steal Months of Your Life, We Need to Rethink What We Are Accepting

Sedric Louissaint — Sat, 04 Apr 2026 00:00:00 GMT

A facial recognition match put a Tennessee grandmother in jail for months over a crime in a state she had never visited. She lost her home, her car, and her dog. The bank records that cleared her were available the entire time.

Unseen Eyes: Navigating Privacy and Security with Flock Cameras

Sedric Louissaint — Thu, 01 Jan 2026 00:00:00 GMT

Flock's cameras can zoom in close enough to read your phone screen, and the researcher who found more than 50 vulnerabilities in the network behind them lost his job for saying so. This is what surveillance at national scale looks like without oversight.

Job and Investment Scams Are Becoming More Sophisticated

Sedric Louissaint — Fri, 28 Nov 2025 00:00:00 GMT

Someone I know was groomed for six months before the fake trading platform ever came up. Modern job and investment scams run on patience, your digital footprint, and AI, and some of them are staffed by people who answered a fake job ad themselves.

Anyone, Please Interact: Two APIs That Never Asked Who I Was

Sedric Louissaint — Sun, 27 Aug 2023 00:00:00 GMT

Two penetration tests, two APIs that never checked. One handed HIPAA-protected medical records to the open internet. The other let anyone pull live card data from an app the bank swore was still in development. Same bug, two costumes.

SqlNow: How One Apostrophe in DeliverNow Turned Into CVE-2021-26837

Sedric Louissaint — Wed, 16 Aug 2023 00:00:00 GMT

I typed a single quote into a log search box on an internal pentest and DeliverNow told me everything. Here is the whole story: the confession in the error message, the xp_dirtree callback, the sa account, and the CVE that came out of it.

AuthForce: Single Sign-On, Single Sign-Over, and the curl That Became CVE-2020-5148

Sedric Louissaint — Wed, 16 Aug 2023 00:00:00 GMT

SonicWall's SSO Agent runs as Domain Admin and authenticates to any workstation it is told about, without ever checking who that is. One curl command through the firewall, one Domain Admin hash. Here is the whole story.

SqlSpark: The Wheels on the Bus Went SELECT * FROM, and That Became CVE-2021-3262

Sedric Louissaint — Wed, 16 Aug 2023 00:00:00 GMT

An internet-facing page where parents look up their child's school bus turned out to take SQL. Here is how one unauthenticated form field became a foothold, a service account, and eventually an entire Active Directory forest.