affiliation
ProjectDiscovery Pioneer
- Authored 950+ Nuclei detection templates used worldwide
- Shapes PD Cloud through beta testing and product guidance
- Authors technical blog content for ProjectDiscovery
latestdelivered ghost in the hiring machine at sector 2026, toronto
~/whoami
security researcher at the shadowserver foundation and part of the executive leadership of the uk osint community. detection research recognised by governments across north america, europe, and asia.
- detection engineering
- osint
- threat intelligence
- attack surface management
synced from about data · 2026-10-13
// recognised byuk ncsccert polskacalifornia csicnist nvdincibecirclgov. of vietnam
// cited bysonicwallcensysblack kitequalysresecuritycoalitionintruderfeedlypositive technologiesdarkwebinformergbhackersthe hacker newscybersecurity newssecurity onlinecyberpresssans stormcastsecurityintelexploit bulletin
~/about
about
His broader background spans enterprise IT, endpoint security, compliance, and infrastructure, giving him a grounding in both the technical detail and the wider operational picture.
Vulnerability researcher and threat intelligence specialist based in London, UK. Security Researcher at The Shadowserver Foundation and part of the executive leadership of the UK OSINT community.
Detection research recognised by governments across North America, Europe, and Asia, and trusted by national cyber authorities and law enforcement. Multi-time DEF CON and BSides speaker; briefed the UK Government and policymakers on risks to critical infrastructure and the software supply chain. Committed open-source contributor authoring detection tooling relied upon by defenders worldwide.
// focus
- vulnerability research
- threat intelligence
- detection engineering
- osint
- attack surface management
- supply chain security
- internet-wide scanning
- phishing detection
- AI security
- public speaking
- mentoring
// tooling show 10
- nuclei
- amass
- nettacker
- shodan
- dns osint
- certificate transparency
- go
- cve / cvss / epss analysis
- honeypots
- signature development
~/about/experience
-
- Engineering detection signatures and internet-wide scans
- Turning honeypot data into actionable detections
- Supporting government cyber response
- Equipping CSIRTs with exposure data
-
- Strengthening sovereign UK intelligence capability
- Produces high-quality OSINT educational content
- Organises and hosts OSINT events across the UK
-
- Led enterprise vulnerability research
- Architected an internet-wide platform scanning millions of assets
- Authored advisories translating CVE, CVSS and EPSS data into business risk
-
- Delivered network and endpoint support within SLA across 500 customers
- Led Windows 10 migration and MFA rollout to 2000 endpoints
- Maintained EPP/MDR, Active Directory and O365 / Google Workspace
-
HSBC Bank Work Experience
~/about/affiliations
affiliation
OWASP Member
- Contributes to Amass, OWASP's attack surface framework
- Contributes to Nettacker, an automated recon framework
- Supported the OWASP Amass workshop at DEF CON 33
~/activity
activity
A real-time feed of vulnerability research, community contributions, and technical advisories.
Rishi@rxerium.com
Had the pleasure of supporting the Global OSINT Conference (@OSINT_Community) last Monday.
A brilliant day of ideas, insight and conversation. Thank you to the sponsors, speakers and everyone who came along!
Some photos below:
Rishi@rxerium.com
Next week I'll be in Toronto, Canada 🇨🇦 to speak at Black Hat SecTor 2026 (Oct 6–8, Metro Toronto Convention Centre).
If you're in town, let's connect! 🤝
#SecTor #BlackHat #Cybersecurity #InfoSec #Toronto
Rishi@rxerium.com
🚨 Reporting a critical vuln in the Issabel Framework (CVE‑2026‑89026), rated CVSS 9.8 with early signs of exploitation in the wild.
The vuln involves a hard-coded JWT signing key that allows unauthenticated attackers to forge tokens and ultimately achieve RCE on the underlying Asterisk system
Rishi@rxerium.com
🚨 Detection for the actively exploited GitLab vulnerability tagged as CVE-2026-85706 (CVSS 10.0) available here:
github.com/projectdisco...
Rishi@rxerium.com
it was a pleasure to present at the conference this year; thank you for hosting such a wonderful event.
Hack Glasgow @hackglasgow.bsky.social
We're delighted to announce that we've now published the recordings for Hack Glasgow 2026!
Rishi@rxerium.com
🚨 PaperCut NG/MF seeing active exploitation in the wild, as reported by @PrevidianCyber
No CVE has been assigned at the time of posting.
~2000 instances of PaperCut NG/MF exposed to the internet which are likely vulnerable
www.shodan.io/search?query...
~/labs
labs
Detection signatures, disclosed CVEs, open-source projects and research. All of it is open source or free to read.
~/labs/signatures
detection signatures
Nuclei templates that turn advisories into scans defenders can run. Many shipped while the bug was being exploited. Open any row for the template header.
-
Detection for an actively exploited, CVSS 10.0 GitLab vulnerability, published in ProjectDiscovery’s Nuclei templates.
id: CVE-2026-85706 info: severity: critical classification: cvss-score: 10.0 # published in projectdiscovery/nuclei-templates -
SSRF in the WorkPlace interface of SMA6210, SMA7210 and SMA8200v appliances. The template matches exact affected hotfix builds, so hits come with high confidence.
id: CVE-2026-15409 info: name: SonicWall SMA1000 WorkPlace - Server-Side Request Forgery (CVE-2026-15409) author: rxerium severity: critical metadata: cvss-score: 10.0 cwe-id: CWE-918 cisa-kev: true tags: cve,cve2026,sonicwall,sma1000,kev,ssrf,workplace,version-check -
Code injection in the SMA1000 appliance management console, exploited in the same campaign as CVE-2026-15409.
id: CVE-2026-15410 info: name: SonicWall SMA1000 AMC - Code Injection (CVE-2026-15410) author: rxerium severity: high metadata: cvss-score: 7.2 cwe-id: CWE-94 cisa-kev: true tags: cve,cve2026,sonicwall,sma1000,kev,code-injection,amc,version-check -
OS command injection that gives unauthenticated attackers root-level code execution. Fixed in 10.5.2, 10.6.2 and 10.7.1.
id: CVE-2026-10520 info: name: Ivanti Sentry < 10.5.2 / 10.6.2 / 10.7.1 - Remote Code Execution author: rxerium severity: critical classification: cvss-score: 10.0 cwe-id: CWE-78 tags: cve,cve2026,ivanti,sentry,rce -
A deserialisation flaw in Jenkins core, exploited in the wild as reported by Defused.
id: CVE-2026-53435 info: name: Jenkins Core - Deserialization Vulnerability author: rxerium severity: high classification: cvss-score: 8.8 cwe-id: CWE-502 tags: cve,cve2026,jenkins,deserialization,rce -
Unauthenticated users can create editor profiles, which leads to PHP upload and code execution. Fixed in JCE 2.9.99.5.
id: CVE-2026-48907 info: name: Widget Factory Joomla Content Editor - Improper Access Control (CVE-2026-48907) author: rxerium severity: critical metadata: cvss-score: 10.0 cwe-id: CWE-284 cisa-kev: true tags: cve,cve2026,jce,joomla,joomla-content-editor,widget-factory,kev,improper-access-control,version-check -
Crafted HTTP requests let an unauthenticated attacker run commands. Affects 4.4.0 to 4.4.8 and is fixed in 4.4.9.
id: CVE-2026-39808 info: name: FortiSandbox - Unauthenticated OS Command Injection (CVE-2026-39808) author: rxerium severity: critical tags: fortisandbox,fortinet,rce,command-injection,version-check,cwe-78 -
Path traversal in the JRPC API lets an unauthenticated attacker bypass authentication. Fixed in 5.0.6 and 4.4.9.
id: CVE-2026-39813 info: name: FortiSandbox - Authentication Bypass via Path Traversal (CVE-2026-39813) author: rxerium severity: critical tags: fortisandbox,fortinet,auth-bypass,path-traversal,version-check,cwe-24 -
SQL injection in FortiClientEMS 7.4.4 that leads to remote code execution. A public exploit is available.
id: CVE-2026-21643 info: name: Fortinet FortiClientEMS 7.4.4 - SQL Injection (RCE) author: rxerium severity: critical classification: cvss-score: 9.8 cwe-id: CWE-89 tags: cve,cve2026,fortinet,forticlientems,sqli,critical -
Detects UniFi Network Application versions exposed to an unauthenticated path traversal.
id: CVE-2026-22557 info: name: UniFi Network Application - Unauthenticated Path Traversal (CVE-2026-22557) author: rxerium severity: critical tags: unifi,ubiquiti,network,path-traversal -
Deserialisation in the License Servlet. The detection was highlighted in the NCSC CTO’s weekly summary and picked up by California CSIC and SonicWall.
id: CVE-2025-10035 info: name: CVE-2025-10035 - Fortra GoAnywhere MFT Critical Deserialization Remote Code Execution author: rxerium severity: critical metadata: cvss-score: 10.0 cwe-id: CWE-502 tags: cve,cve2025,critical,goanywhere,deserialization,rce -
Post-authentication remote code execution through PHP object deserialisation. CERT Polska adopted the template.
id: CVE-2025-49113 info: name: CVE-2025-49113 - Roundcube Webmail PHP Object Deserialization RCE author: rxerium severity: critical metadata: cvss-score: 9.9 cwe-id: CWE-502 tags: cve,cve2025,roundcube,deserialization,rce,zero-day -
Stored XSS in the LiteSpeed Cache WordPress plugin, co-authored with sorrowx3. Featured by NIST’s NVD.
id: CVE-2023-40000 info: name: CVE-2023-40000 - LiteSpeed Cache WordPress Plugin XSS author: rxerium,sorrowx3 severity: medium classification: cvss-score: 6.1 cwe-id: CWE-79 tags: cve,cve2023,wordpress,wp-plugin,litespeed-cache,xss -
Insecure deserialisation in the N-central RMM platform before 2025.3.1, exploited in the wild.
id: CVE-2025-8875 info: name: CVE-2025-8875 - N-able N-central Insecure Deserialization Code Execution author: rxerium severity: critical metadata: cvss-score: 9.0 cwe-id: CWE-502 cisa-kev: true tags: cve,cve2025,kev,n-able,ncentral,deserialization,rce -
Command injection in N-central, exploited in the wild alongside CVE-2025-8875.
id: CVE-2025-8876 info: name: CVE-2025-8876 - N-able N-central Command Injection Code Execution author: rxerium severity: critical metadata: cvss-score: 9.0 cwe-id: CWE-77 cisa-kev: true tags: cve,cve2025,kev,n-able,ncentral,command-injection,rce -
Directory traversal in the RouterOS WinBox service.
id: CVE-2018-14847 info: name: CVE-2018-14847 - MikroTik RouterOS WinBox Directory Traversal author: rxerium severity: critical classification: cvss-score: 9.1 metadata: cisa-kev: true tags: cve,cve2018,kev,mikrotik,routeros,router,passive -
OS command injection in the D-Link DCS-930L network camera.
id: CVE-2016-11021 info: name: CVE-2016-11021 - D-Link DCS-930L OS Command Injection author: rxerium severity: high classification: cvss-score: 7.2 metadata: cisa-kev: true tags: cve,cve2016,kev,dlink,dcs930l,camera,passive -
Command injection in D-Link DCS-2102 and DCS-2121 network cameras.
id: CVE-2013-1599 info: name: CVE-2013-1599 - D-Link Camera Command Injection author: rxerium severity: critical classification: cvss-score: 10.0 tags: cve,cve2013,dlink,dcs2102,dcs2121,camera,passive
no signatures match that search. try “fortinet” or “cwe-502”.
~/labs/cves
cves disclosed
11 vulnerabilities disclosed by Rishi, 3 of them critical. Each links to its record on cve.org.
CVE-2026-89026critical
Issabel Framework / Issabel PBX
hardcoded JWT key → RCE
Identical hard-coded HS256 JWT signing key across every install allows unauthenticated attackers to forge bearer tokens and invoke the manager originate endpoint for remote command execution. Exploited in the wild.
CVE-2023-54399critical
Hongjing e-HR < 8.2
SQL injection · unauthenticated
UNION SELECT injection via the categories parameter on /servlet/codesettree exposes arbitrary database content including credential tables.
CVE-2023-54400critical
Fumasoft Fumeng Cloud
SQL injection · unauthenticated
UNION-based injection through the Name parameter of the getEmpByname action on AjaxMethod.ashx against a MSSQL backend — read and modify database contents.
CVE-2024-58388high
Sharp / Toshiba Tec MFPs
local file inclusion
Directory traversal via the path parameter on installed_emanual_down.html reads arbitrary files outside the manual directory.
CVE-2024-58387high
Inspur Haiyue HCM Cloud
arbitrary file read
Unvalidated index / ext parameters on /api/model_report/file/download traverse the filesystem and disclose sensitive files such as /etc/passwd.
CVE-2023-54403high
Yonyou U8 CRM < V16.5 / V18
arbitrary file read · auth bypass
DontCheckLogin=1 bypass plus unvalidated filePath on /ajax/getemaildata.php reads config files and other sensitive paths outside the web root.
CVE-2023-54402high
iDocView
SSRF → local file read
Hard-coded default token (testtoken) bypasses auth on /doc/upload; unrestricted URL schemes including file:// expose local OS and app files.
CVE-2021-48008high
Chanjet CRM
SQL injection · unauthenticated
UNION-based injection via the site_id parameter on the webservice endpoint extracts sensitive data from the backend database.
CVE-2019-25776high
Weaver E-cology
SQL injection · unauthenticated
UNION injection through userIdentifiers on the mobile plugin endpoint, bypassing space-based filters to dump admin credentials and sensitive rows.
CVE-2017-20284high
Caucho Resin (resin-doc)
path traversal
Relative-path input through inputFile on the jndi-appconfig tutorial servlet reads arbitrary files outside the documentation webapp.
CVE-2015-20122high
Seeyon A6 OA
SQL injection · unauthenticated
UNION injection via attach_ids on downloadAtt.jsp dumps arbitrary database content with no authentication required.
~/labs/projects
open-source projects
Open-source tooling, detection content and research, built and maintained on GitHub.
- stars
- 532
- forks
- 82
- public repos
- 71
- followers
- 188
// commits · last 12 months · on github since 2019
- pair extraordinaire ×2
- starstruck ×2
- pull shark ×3
- galaxy brain
- yolo
- public sponsor
- quickdraw
★ flagship · open source
rxerium-templates
Open-source Nuclei detection templates for critical CVEs — battle-tested CVE detections used worldwide, from phishing infrastructure to critical RCE.
- templates
- 950+
- merged upstream prs
- 159
- global pioneer
- 7th
open source
CISA-KEV
Automated tracking of Nuclei template scanning capabilities against CISA's Known Exploited Vulnerabilities catalog.
★ flagship · upstream
OWASP Amass (contributor)
Contributing to OWASP's attack surface discovery framework used by defenders worldwide, and supported the Amass workshop at DEF CON 33.
open source
cms-exploitation-campaign
Large-scale exploitation campaign against CMS devices reported in July 2026.
open source
ai-bot-ip-ranges
Official IP ranges for AI bot crawlers — OpenAI, Anthropic, Google, Microsoft, Perplexity. Weekly auto-updates.
open source
responsible-disclosure-email-gathering
Workflow to gather responsible disclosure emails from given hosts.
~/labs/research
research & write-ups
Long-form research on the blog, plus guest posts and community work.
blog
research archive and selected write-ups
A chronological index of articles, grouped by year and topic, with the most recent security research surfaced first.
$ ls -t ~/posts
rxerium.com/posts · rssbrowse archive
// also
- community spotlight: rishi (@rxerium)interview · projectdiscovery · jul 2026
- fishing for phishing with nuclei templatesresearch post · projectdiscovery · mar 2024
- ethical implications of osint in personal data collectionresearch post · osint.uk · apr 2025
- uk osint community trainingyoutube channel · youtube.com/@UKOSINT
~/talks
talks
Multi-time DEF CON speaker across the Red Team, Recon and Social Engineering Villages, plus the BSides circuit in Europe and the US, OWASP London, Hack Glasgow and ElbSides Hamburg.
- total sessions
- 20+
- countries
- 9
- workshops
- 2
// sessions by year
latest · delivered SecTor 2026, Toronto, Oct 6–8
How fake personas slip through technical hiring, and the OSINT techniques that expose them. Co-presented with Michael Reimsbach at BSides Las Vegas and DEF CON.
- elbsideshamburg
- bsides las vegaslas vegas
- def con 34las vegas
- hack glasgowglasgow
- bsides krakowkrakow
- sector 2026toronto
Using DNS-based OSINT to find product and service exposure fast, with the Salesloft Drift exposure as the case study.
- def con 33red team village · las vegas
- bsides cymrucardiff
- bsides portoporto
- owasp londonlondon
- bsides pragueprague
- bsides luxembourgesch-sur-alzette
Turning one-off phishing hunts into Nuclei templates that find phishing infrastructure at scale.
- bsides budapestbudapest
- bsides luxembourgesch-sur-alzette
Two hands-on workshops in the DEF CON 34 Social Engineering Village (Zero Day Hire), AI roundtables in Budapest, a security research briefing for the UK Government and policymakers, and a ProjectDiscovery community spotlight interview.
- uk government briefinglondon
- bsides budapestbudapest
- current state of aibudapest
- def con 34se village · workshop 1
- def con 34se village · workshop 2
- projectdiscoveryremote
// every talk, workshop and roundtable, with listings and decks
~/recognition
recognition
Detection research recognised by governments across North America, Europe, and Asia, and trusted by national cyber authorities and law enforcement.
NCSC (UK Government)
Recognised detection script for GoAnywhere MFT exploitation.
CERT Polska
Adopted detection scripts into Artemis tooling.
California Cyber Security Integration Center
Cited detection in an official cyber advisory.
NIST / NVD
Featured detection script on the official advisory page.
Spanish Government Agency (INCIBE)
Referenced detection script in national guidance.
CIRCL (Luxembourg)
Referenced vulnerability research across advisories.
research
Gov. of Vietnam
Cited detection work in national advisories.
advisories
BSides Las Vegas · Aug 2025
Won the ProsVJoes capture-the-flag competition.
winner
// vendor citations
Detection research cited across vendor advisories and threat reports.
- SonicWall
- Censys
- Black Kite
- Qualys
- ReSecurity
- Coalition
- Intruder
- Feedly
- Positive Technologies
- DarkWebInformer
// press coverage
Press and news coverage from across the internet.
- GBHackers
- The Hacker News
- Cybersecurity News
- Security Online
- CyberPress
- +7 more outlets
// podcasts & newsletters
Research discussed on air and in leading security briefings.
~/contact
contact
Build something secure together.
Open to high-impact security collaborations & speaking engagements.
replies in ~24–48 hours · london, UK / remote
// communication channels