Introducing Source Code Connect your repository and scan any branch, commit, or tag for actionable source code findings. Try it now

Mohammed Lachhab

Security Engineer LinkedIn

Mohammed Lachhab is a Security Engineer at Ostorlab, where he combines hands-on security research with content strategy. He conducts in-depth research on vulnerabilities, cybersecurity tools, and emerging threats to produce educational content that is both technically accurate and accessible. All articles are reviewed by the engineering team for technical rigor, helping Ostorlab communicate complex security topics clearly to professionals and security teams.
Articles by Mohammed Lachhab

Security

AI Pentesting Prompts That Produce Evidence, Not Just Findings

A practical guide to designing AI-assisted security testing workflows that turn scoped evidence into reviewable findings through structured outputs, validation gates, and controlled execution.

Mohammed Lachhab
Thu 23 July 2026

Security

Exploit CVE-2026-44109 : OpenClaw Feishu Webhook Authentication Bypass to RCE

A technical breakdown of CVE-2026-44109, a CVSS 9.2 Critical authentication bypass vulnerability ...

Thu 07 May 2026

Security

CVE-2026-5205: Critical SSRF in Chatwoot — How a Single Upload Parameter Exposes Cloud Credentials

A deep dive into a critical Server-Side Request Forgery (SSRF) vulnerability in Chatwoot's upload...

Wed 29 April 2026

Security

Twenty CRM Serverless Functions Expose Critical RCE and Permanent Unauthenticated Backdoor Risk (CVE-2026-26720) - PoC & Exploit

A technical breakdown of CVE-2026-26720, a CVSS 9.8 Critical authenticated Remote Code Execution ...

Wed 15 April 2026

Security

CVE-2026-2599 : Unauthenticated PHP Object Injection → WP_HTML_Token POP Chain

A technical breakdown of CVE-2026-2599, a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the "Contact Form Entries" WordPress plugin (≤ 1.4.7). The download_csv function deserializes untrusted user input without allowed_classes restrictions. When combined with WordPress 6.4.0-6.4.1, the built-in WP_HTML_Token class provides a complete all-public POP chain leading to full Remote Code Execution via two unauthenticated HTTP requests.

Wed 25 March 2026

Security

GHSA-cr3w-cw5w-h3fj: 1-Click RCE in Saltcorn

Analysis of GHSA-cr3w-cw5w-h3fj, a CVSS 9.7 critical XSS-to-RCE vulnerability in Saltcorn (≤ 1.5.0-beta.19). Two chained flaws, reflected XSS in route parameters and command injection in backup generation, enable remote code execution via administrator phishing.

Wed 11 March 2026

Latest posts

Security

CVE-2026-1357: Unauthenticated RCE in WPvivid Backup Plugin

A technical breakdown of CVE-2026-1357, a CVSS 9.8 critical unauthenticated remote code execution vulnerability in the WPvivid Backup & Migration plugin (≤ 0.9.123). Two chained flaws, a cryptographic fail-open and an unsanitized path traversal, allow arbitrary file write and shell upload without credentials.

Fri 20 February 2026

Changelog

View all changes