Introducing Source Code Connect your repository and scan any branch, commit, or tag for actionable source code findings. Try it now

Aziz Elbelaychy

Security Engineer LinkedIn

Aziz is a Security Engineer Intern at Ostorlab. He specializes in application security and offensive security testing. He conducts deep-dive vulnerability analysis across web and mobile applications, leveraging his background in penetration testing, and also delivers vulnerability research and robust assessments to help organizations proactively secure their attack surfaces. His research and technical findings are rigorously reviewed by the Ostorlab engineering team for accuracy and reproducibility.
Articles by Aziz Elbelaychy

Security

Can SOC 2 Accept an AI-Conducted Penetration Test?

SOC 2 doesn't name a required testing method, so auditors judge evidence, not tools. Here's what an AI-conducted penetration test actually needs to satisfy a SOC 2 Type II audit.

Aziz Elbelaychy
Thu 06 August 2026

Security

How AI Catches Complex Vulnerabilities: Inside Agentic Pentesting and Exploit Chaining

Discover how agentic AI catches business logic flaws rule-based scanners miss. See a real exploit...

Tue 28 July 2026

Security

DirtyFrag: Universal Linux Local Privilege Escalation via Page-Cache Write

A technical breakdown of DirtyFrag, a pair of Linux kernel local privilege escalation vulnerabili...

Wed 13 May 2026

Security

Inside BeatBanker / BTMOB: Static Analysis of TV_V_23.apk, a Multi-Stage Android Banking Malware Platform

A static analysis of TV_V_23.apk, a multi-stage Android banking malware platform attributed with ...

Tue 28 April 2026

Security

New Roundcube Webmail Vulnerabilities Disclosed : IMAP Command Injection and SSRF via CSS Proxying.

A deep dive into two critical vulnerabilities uncovered in Roundcube Webmail (< 1.6.14, 1.5.14, 1.7 RC4) during a source code review. OVE-2026-8 allows authenticated attackers to inject arbitrary IMAP commands via the _filter parameter due to missing CRLF sanitization. OVE-2026-9 enables Server-Side Request Forgery (SSRF) by exploiting the CSS proxying mechanism, allowing access to internal network resources and cloud metadata.

Wed 08 April 2026

Security

CVE-2026-27971 : Qwik server$ Unauthenticated Remote Code Execution

A technical breakdown of CVE-2026-27971, a CVSS 9.2 critical unauthenticated remote code execution vulnerability in Qwik (< 1.19.1). Unsafe deserialization in the server$ RPC flow allows attacker-controlled QRL objects to be reconstructed from application/qwik-json requests, enabling arbitrary module path and symbol resolution and, where require() is available,remote code execution via crafted server-side function invocation.

Wed 01 April 2026

Latest posts

Security

Exploit CVE-2025-68461 : Roundcube Webmail SVG Animate XSS Sanitizer Bypass

A technical breakdown of CVE-2025-68461, a CVSS 7.2 high stored Cross-Site Scripting vulnerability in Roundcube Webmail (< 1.5.12 and < 1.6.12). The rcube_washtml sanitizer blocks SVG \ tags that target the href attribute, but the attribute_value() comparison does not strip XML namespace prefixes before matching. An attacker can use attributeName="xlink:href" to bypass the check entirely, delivering unsanitized javascript: URIs in the values attribute directly into the rendered email DOM. JavaScript execution is currently prevented by an accidental namespace corruption in PHP's DOMDocument::loadHTML() which strips the xlink namespace declaration, but the sanitizer bypass is confirmed and the vulnerability remains exploitable under alternative parser configurations such as the Masterminds HTML5 parser or PHP 8.4's Dom\HTMLDocument.

Tue 17 March 2026

Security

CVE-2026-26019 : LangChain RecursiveUrlLoader Server-Side Request Forgery Vulnerability

A technical breakdown of CVE-2026-26019, a CVSS 4.1 medium Server-Side Request Forgery vulnerability in the LangChain Community JavaScript package (< 1.1.14). The RecursiveUrlLoader class uses a naive string prefix check to validate crawled URLs, allowing an attacker to bypass the default preventOutside restriction with a suffixed domain and redirect the crawler to internal network assets, potentially exposing sensitive credentials and metadata endpoints.

Wed 04 March 2026

Security

CVE-2025-64712: Path Traversal RCE in Unstructured Library MSG Processing

A technical breakdown of CVE-2025-64712, a CVSS 9.8 critical path traversal remote code execution vulnerability in the Unstructured Python library (< 0.18.18). Unsanitized attachment filenames in Outlook MSG processing allow for path traversal, enabling an attacker to overwrite arbitrary files via a crafted MSG file and achieve code execution.

Mon 23 February 2026

Changelog

View all changes