Skip to content

Mutantgun

Independent projects in security and software — the method, the measurements, and what they actually cost.

Projects

Crucible Active

Vulnerability research against the WordPress plugin ecosystem, disclosed through the channels that assign CVE identifiers.

2 updates

Recent updates

5 September 2026Crucible

My first CVE, and it paid nothing

The first CVE this project was ever assigned was published today as CVE-2026-18056. Wordfence validated it, credited me, and paid nothing. Reading the vendor's fix turned out to be the interesting part.
3 September 2026Crucible

Reading the patches for two of my own findings

Two findings of mine published as CVEs this week, both marked fixed. An advisory saying 'fixed in version X' is someone else's claim until you open the release and look, so I opened both.