New vulnerability disclosure from
@chocapikk_:

CVE-2026-14863 is an OS command injection-to-RCE in FileRun, a commercial self-hosted file manager. Internet footprint is an appreciable 3.5K or so based on the team's ASM queries. Good stuff as always from Valentin.

https://www.vulncheck.com/blog/filerun-thumbnail-command-injection-rce

New vuln disclosure out from
@chocapikk_: Unauth SSRF in Monsta FTP (CVE-2026-60105), makes for a nice primitive. Silently fixed a couple weeks ago, go figure. Full details + PoC out on the @vulncheck blog: https://www.vulncheck.com/blog/monsta-ftp-ssrf-ipv6-blocklist-bypass

Also, for the love of sky chicken, do NOT send me AI-generated resumes. I get so many of them. So, so many of them. I do not care if you match every single bullet point in the job description — if that's all your CV is doing, it doesn't stand out anymore and it goes straight in the trash. I get thousands of resumes for these roles. If you want to stand out, write it as a gd* human, please. Robots are a dime a million. Actual brains aren't. Show me you have one, and I'll listen.

I have 1,746 unread emails, please someone who is good at the vuln economy help me budget this, my family* is dying**

* researchers
** no they're not

H'OKAY, SO:

We're #hiring so so many roles on the VulnCheck research team right now. I'm basically hiring full-time. I would love to do other things, too. I would love to write about vulns and threats. I would love to rEaD emAiLs. I would love to "touch grass." But I cannot, because all I do is *hire hire hire* (apparently a corporate version of WIN WIN WIN).

Anyway, we're looking for exceptional U.S. and UK-based folks who are real dang good at vulns and exploits:

• Exploit developers who are comfortable working on enterprise, network edge, and OT/IoT targets on tight timelines
• An exploit development team lead who can balance global technical mentorship with individual execution on tough targets
• Offensive-minded engineers with experience developing AI systems for vuln research use cases and active cyber defense

If you're good at VULNS and want to exploit VULNS and talk about VULNS and also help global orgs prioritize VULNS better...hit me up 😇 Careers page below! Location does matter, and we don't currently sponsor visas (sorry!) #remotework

https://www.vulncheck.com/careers

Also! I bloody hate weapons or military metaphors for cybersecurity. There are plenty of public health metaphors we can use. Please for f's sake let's not give missile/gun comparisons more power. They don't need it.

#introduction —
I head up security research at @vulncheck, including initial access intelligence, vulnerability analysis, and CVD. Previously, I managed vulnerability research, emergent threat response, and the open-source @metasploit R+D group at Rapid7. I'm not entirely sure how I got here: A former engineering director made a crazy decision that sure, why not, let's put the comms person in charge of the research team, and somehow, it worked. I am extraordinarily lucky; the teams I've had the privilege of running are magnificent, and the @metasploit crew are the kindest and brilliant-est humans on the planet.

I used to travel all over the world by myself, from Ethiopia and Lesotho and the Philippines to Madagascar and India and Guatemala. I busted my knees hiking a long trail in Nepal in 2016, which I hurried (against my body's wishes) because I wanted to get back to a town with internet to see the U.S. elect its first female president. That didn't work out in a number of key ways. Now, I write research reports and try to hobble around after my three little nephews (edit: there used to be just one, but they've multiplied!) while I await another major knee surgery to fix what I broke.

I hope I get to travel the way I used to again one day; I don't know if I will. I'll tell ya, though, if these knees ever work again like they used to, I'm outta here immediately — one thing I learned while traveling is that the world is fragile. I couldn't go back to places in Kenya or Ethiopia now that I loved in 2016. Who knows what shape Georgia or Armenia or Kyrgyzstan will be in three years from now. YOLO.