Field notes
Notes from the work.
Security research, infrastructure, and software investigations—from the first observation to the result.
Latest
October 2026
A log field became an Elasticsearch command
Fluent Bit let one untrusted log record add an authenticated Elasticsearch write or delete.
From a failed allocation to RCE in Fluent Bit
Network-driven command execution on a pinned source-built glibc target, the official-image boundary, and the advisory that never appeared.