Beerus Framework: v1.1 - KernelSU, gRPC Transport e Correções
Alguns meses após o lançamento inicial do Beerus Framework, estamos publicando a versão v1.1, uma atualização minor que traz suporte a novos ambientes
RESEARCH AREA
Research Blog
Discovering 0-days in HTML-to-PDF Generators (90 million monthly targets)
By Pedro "gankd" Cruz — Pentest Analyst and Vulnerability Researcher at Hakai Security. Almost every feature-rich application emits a PDF at some
Descobrindo 0-days em Geradores HTML-to-PDF (90 milhões de alvos mensais)
* Por Pedro "gankd" Cruz — Pentest Analyst & Vulnerability Researcher na Hakai Security. Quase toda aplicação com diversas funcionalidades emite PDF em algum
![[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/06/blog_sqlinjec.png)
[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService
Summary The Hakai Security Research Team has identified a critical SQL Injection vulnerability in Chatwoot versions <= 4.11.1 that allows any authenticated
[PT-BR] CVE-2026-44706: SQL Injection in Chatwoot FilterService
Resumo A Equipe de Pesquisa da Hakai identificou uma vulnerabilidade crítica de Injeção de SQL nas versões do Chatwoot <= 4.11.1 que
Reverse Engineering SmartLoader: Where Commodity Malware and Operational Tooling Diverge
Introduction SmartLoader is a commodity loader currently in active deployment, attributed to Malware-as-a-Service infrastructure that has been linked to LummaStealer delivery
![[EN] CVE-2026-4802: Command execution on Cockpit](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/05/artigo_blog_cockpit.png)
[EN] CVE-2026-4802: Command execution on Cockpit
A command injection vulnerability has been identified in Cockpit, discovered by Hakai's Research team. The flaw allows an authenticated user, even without
[PT-BR] CVE-2026-4802: Command execution on Cockpit
Foi identificada uma vulnerabilidade de injeção de comandos no Cockpit, descoberta pelo time de Research da Hakai. A falha permite que um usuário autenticado,
![[EN] CVE-2026-33725: Technical Analysis and Proof of Concept](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/05/artigo_blog_metabase.png)
[EN] CVE-2026-33725: Technical Analysis and Proof of Concept
On March 24, 2026, a high-criticality vulnerability was identified in Metabase Enterprise leading to remote command execution, discovered by "Hacktron AI and