Beerus Framework: v1.1 - KernelSU, gRPC Transport and Fixes
A few months after the initial release of the Beerus Framework, we are publishing version v1.1, a minor update that brings support for
RESEARCH AREA
en
Discovering 0-days in HTML-to-PDF Generators (90 million monthly targets)
By Pedro "gankd" Cruz — Pentest Analyst and Vulnerability Researcher at Hakai Security. Almost every feature-rich application emits a PDF at some
![[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/06/blog_sqlinjec.png)
[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService
Summary The Hakai Security Research Team has identified a critical SQL Injection vulnerability in Chatwoot versions <= 4.11.1 that allows any authenticated
Reverse Engineering SmartLoader: Where Commodity Malware and Operational Tooling Diverge
Introduction SmartLoader is a commodity loader currently in active deployment, attributed to Malware-as-a-Service infrastructure that has been linked to LummaStealer delivery
![[EN] CVE-2026-4802: Command execution on Cockpit](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/05/artigo_blog_cockpit.png)
[EN] CVE-2026-4802: Command execution on Cockpit
A command injection vulnerability has been identified in Cockpit, discovered by Hakai's Research team. The flaw allows an authenticated user, even without
![[EN] CVE-2026-33725: Technical Analysis and Proof of Concept](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/05/artigo_blog_metabase.png)
[EN] CVE-2026-33725: Technical Analysis and Proof of Concept
On March 24, 2026, a high-criticality vulnerability was identified in Metabase Enterprise leading to remote command execution, discovered by "Hacktron AI and
Chupabase: Extracting Data from Misconfigured Lovable Applications
Abstract Applications developed with vibe coding platforms are significantly lowering the barrier to entry for software creation. Tools like Lovable allow users to build
CVE-2026-25769: RCE via insecure deserialization in wazuh cluster - remote command execution through cluster protocol
Abstract In this research, Hakai Security Research Team has identified a critical Remote Code Execution (RCE) vulnerability in Wazuh versions up to 4.14.
![[EN] Deep Looking into Centreon](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/03/texugo.png)
[EN] Deep Looking into Centreon
Summary In this research, three critical vulnerabilities were identified in Centreon Web and the Centreon Open Tickets module, allowing everything from full database extraction