Backend systems, and the security problems they tend to create.
I’m a Technical Lead at Cubet Techno Labs, where I’ve worked since 2021 — serverless commerce backends on AWS, and dragging a Learning Management System from Slim 3 to Slim 4 and PHP 8.2 without breaking it.
Outside that I publish compression libraries, contribute where I can, and volunteer with the Kerala Police Cyberdome, taking the occasional consulting engagement when it fits around that.
Linux Foundation, LFEL1002.
Linux Foundation, LFD103.
An x86_64 kernel in Rust with no blocking primitives. Asynchronous submission is the only interface it offers.
SSRF bypass in RecursiveUrlLoader via insufficient URL origin validation
RecursiveUrlLoader's preventOutside option used String.startsWith() to decide whether a discovered link was same-site, so a page under https://example.com.attacker.com passed a check written against https://example.com. There was also no filtering of private or reserved IP ranges, so a crawled page could redirect the loader at cloud metadata endpoints such as 169.254.169.254, at localhost, or at RFC 1918 addresses — potentially exposing IAM credentials. The fix replaced the prefix comparison with a strict new URL(x).origin comparison and added an SSRF validation module applied before every outbound fetch.
Credited as reporter on GHSA-gf3v-fwqg-4vh7, published 2026-02-11. CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N.
An injection vector in query-builder index hints
forceIndex() and inRandomOrder() passed their argument into the compiled SQL without validation. I reported it through Laravel’s security process, wrote the patch, and it shipped across the MySQL, SQLite and SQL Server grammars.
The part most people would leave out
Laravel didn’t issue a CVE for it. The maintainers' position was that not passing user input into an index hint is the developer's responsibility — the same contract as DB::raw(). They aren't wrong: nothing in the docs ever suggested those arguments were escaped.
The patch shipped anyway, which is the right outcome. A framework can hold a documented contract and still refuse to compile a string that could never be a valid index name. That's defence in depth, and it costs one preg_match. It’s also why the langchain finding above is worth reading alongside this one: when the process does end in a CVE, that’s reported just as plainly.