Ali Firas | The Smart Shadow

Security Researcher & Zero-Day Researcher. Mostly vulnerability research, source code, and rabbit holes that start with one weird line of code.

[Ali Firas | The Smart Shadow @thesmartshadow_]

They marked it fixed.
I tested the fix.

The result was another CVE and a working exploit chain: attacker-controlled heap corruption in rust-openssl, alive for 3+ years across 53 downstream products.

CVE-2026-45784
Ali Firas | @thesmartshadow

https://t.co/EshW8PWWyf

[Ali Firas | The Smart Shadow @thesmartshadow_]

By the grace of God, my Microsoft APM research led to CVE-2026-45539 / EUVD-2026-30561.

A malicious package could use a symlink to escape the package root and read local host files during "apm install".

Affected: 0.5.2–0.12.4
Fixed: 0.13.0
@msftsecresponse
#Microsoft #Cyber

[Ali Firas | The Smart Shadow @thesmartshadow_]

@0xFars Thx a lot bro rly appreciate u

[Ali Firas | The Smart Shadow @thesmartshadow_]

CVE-2026-39360 in @RustFSofficial

UploadPartCopy lacks a source authorization check allowing cross tenant data exfiltration without s3:GetObject

Affected: alpha.1 to alpha.90
Fixed: alpha.91

https://t.co/bmtkRqV4uY

#CVE #SecurityResearch #RustFS

[Ali Firas | The Smart Shadow @thesmartshadow_]

By the grace of God I’m sharing CVE-2026-34601 from my research in xmldom now listed by ENISA as EUVD-2026-18460

The flaw survived for 14+ years in a package with ~40M weekly downloads and triggered fixes across major software supply chains

#CVE #Cybersecurity

[Ali Firas | The Smart Shadow @thesmartshadow_]

@hack_313 @msftsecresponse Thx fr bro ♥️

[Ali Firas | The Smart Shadow @thesmartshadow_]

Security research is a long process of reading code, testing assumptions, and responsible disclosure.
Honored to be included in the @msftsecresponse MSRC Special Mentions 2026.
https://t.co/spY1o2ytee

#CyberSecurity #MSRC #VulnerabilityResearch #InfoSec

[Ali Firas | The Smart Shadow @thesmartshadow_]

Grateful to share CVE-2026-32808 in pyLoad: Arbitrary File Deletion via Path Traversal during encrypted 7z password verification.

CVSS 8.1 HIGH. Registered as EUVD-2026-13435.

Discovered with Ali Firas - thesmartshadow / Ali Alakbar - ExeC_IQ.

#CVE #OpenSourceSecurity

[Ali Firas | The Smart Shadow @thesmartshadow_]

Glad to be acknowledged by @BerkeleyLab for helping keep lab websites safe. Grateful for the recognition.
Ali Firas - thesmartshadow
#cyber #bug

[Ali Firas | The Smart Shadow @thesmartshadow_]

This one means a lot to me

A security issue I reported in Google’s Human I O research was accepted and fixed after a long follow up

The patch I wrote was merged and I was added to the Contributors list

Also honored on Google Bug Hunters Honorable Mentions
#Google #BugHunters

[Ali Firas | The Smart Shadow @thesmartshadow_]

Proud to share that my finding in docopt.cpp is now CVE-2025-67125: an integer overflow that may cause logic bypass and DoS across multiple ecosystems. Deep source review still matters. #CyberSecurity #CVE #Cpp

[Ali Firas | The Smart Shadow @thesmartshadow_]

Just found and reported a security issue in a Google Research open-source project,
Caught it during a manual code review, digging into security-sensitive logic
Honestly, working on real security improvements in research-driven
open source hits different.
https://t.co/jICaZt7sId

[Ali Firas | The Smart Shadow @thesmartshadow_]

Scanners miss the real bugs.
The dangerous ones live in source code: memory issues, logic flaws, and architectural weaknesses.
Safa and I break down Sink-to-Source vulnerability research here:
https://t.co/3Z8fJcv6Ca
#AppSec #SourceCodeReview #VulnerabilityResearch #CyberSecurity

[Ali Firas | The Smart Shadow @thesmartshadow_]

Just dropped a write-up on CVE-2025-59717

While auditing "@digitalocean/do-markdownit" I found a subtle allow-list bypass caused by JavaScript’s polymorphic ".includes()" behavior.

Full write-up:
https://t.co/kNglAw3u1n

#cve #cybersecurite

[Ali Firas | The Smart Shadow @thesmartshadow_]

My first CVE didn’t stop at global disclosure.
It’s now officially registered by the EU Cybersecurity Agency (ENISA) in the European Vulnerability DB EUVD-2025-30235 expanding real-world supply-chain
CVE-2025-59717
Ali Firas (thesmartshadow)
#CVE #EUVD #0day #SecurityResearch

[Ali Firas | The Smart Shadow @thesmartshadow_]

CVE-2025-63095
​I've discovered a new 0-day in Tempus Ex
A critical Logic Flaw in write_bits() causing Silent Data Corruption or DoS, with RCE potential in low-level bitstream processing.
​ Ali Firas (thesmartshadow)
​#SourceCodeReview #0day #BinaryExploitation #Infosec

[Ali Firas | The Smart Shadow @thesmartshadow_]

CVE-2025-59716 (ownCloud Guests Zero-Click Identity/Email Enumeration from an auth/state validation logic flaw I found via source-code review.
Credit: Ali Firas (thesmartshadow) | Refs: NVD · Tenable · https://t.co/VIDaHL3gOm · Ubuntu · Red Hat · IBM

[Ali Firas | The Smart Shadow @thesmartshadow_]

New milestone accepted report in the U.S. HHS Responsible Disclosure Program powered by Synack Auth boundary weakness on a federal NIH asset validated, fixed, and re-tested. Proud to help harden public-sector systems.
Ali Firas (thesmartshadow)

https://t.co/LiYCBJGgJk

#cyber

[Ali Firas | The Smart Shadow @thesmartshadow_]

Honored to be recognized by Lawrence Berkeley National Laboratory (Berkeley Lab) in their White Hats for Science VDP kudos listed as Ali Firas Cybersecurity Researcher.
https://t.co/tFJZHjooKz
#CyberSecurity

[Ali Firas | The Smart Shadow @thesmartshadow_]

@HunterMapping https://t.co/vcfigdPCAW