Pleased to publish a browser-related research paper (w/@inzo____) titled: One trigram at a time: XSLeak via Universal CSS Injection and DoS in Opera (GX) The title speaks for itself. Enjoy the read! zhero-web-sec.github.io/rese…

Paper currently being written. Expected to be the next publication, God willing. As no companies have yet been found whose vision and values truly align with ours, sponsorships, partnerships, and selective intellectual property transfers related to ongoing and future research remain open for discussion.

New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____): Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js zhero-web-sec.github.io/rese…

Now open to sponsorships, partnerships, and selective intellectual property transfers related to ongoing and future research. Current model: fully independent vulnerability research funded through bug bounty activity, with no consulting or commercial services. Interested parties can reach out via DM or via the email listed on the blog.

Happy to publish our first research of the year on the SvelteKit framework, downloaded over 800,000 times per week, which led to CVE-2025-67647 (w/@inzo____): Avoiding the paradox: A native full-read SSRF and one‑shot DoS in SvelteKit zhero-web-sec.github.io/rese… Enjoy the read

Voting is now open, with three of my papers nominated: 1. Eclipse on Next.js: Conditioned exploitation of an intended race-condition 2. Next.js, cache, and chains: the stale elixir 3. Astro framework and standards weaponization take a moment to vote! portswigger.net/polls/top-10…

We unfortunately won’t be able to publish our latest paper before the end of 2025 as the maintainers chose to delay it until early January. Still, it’s been a productive year of zero-day discoveries, with a focus on frameworks, many of which were shared on the blog. 2025 Recap:

second research on Astro, a shorter paper than usual, which led to CVE-2025-64764 (w/ @inzo____): Unlocking Reflected XSS in the Astro framework zhero-web-sec.github.io/rese… all applications using the Server Island feature are vulnerable

release of our new paper (w/ @inzo____) which resulted in CVE-2025-64525: Astro framework and standards weaponization from path-based middleware protection bypass to potential SSRF & XSS + full bypass of CVE-2025-61925 on @astrodotbuild zhero-web-sec.github.io/rese…

to echo my last post, your big, influential app with millions of users is surely secure against this probably the most surprising(?) vulnerability of my short career; sometimes you just need to reach out your arm (almost literally), right @inzo____?

frameworks, frameworks with @inzo____

new discovery: cache poisoning on next.js - CVE-2025-49826 indefinite caching of a 204 response, rendering the affected pages inaccessible affected versions: >15.0.4 and <15.2.0 there will be no research paper for this one

Bug bounty, feedback, strategy, and alchemy frequently asked for advice, roadmaps, and more, I finally took the time, after 2–3 years of bug bounty, to write down my vision, thoughts and perspective on the subject non-technical, no research this time! zhero-web-sec.github.io/thou…