Blog
Notes from the engine room
What I found, what I fixed, and what I could not prove. Mostly CVEs and runtime internals.
- CVE-2026-45756: attacker-controlled regex in Symfony JsonPath filters (ReDoS) A JSONPath filter taken from a query string lets an attacker pick the regex a Symfony app runs, once per node in the document.