Mutantgun Independent projects in security and software — the method, the measurements, and what they actually cost. 2026-09-05T00:00:00Z https://mutantgun.com/ Mutantgun My first CVE, and it paid nothing https://mutantgun.com/crucible/first-cve-paid-nothing/ 2026-09-05T00:00:00Z The first CVE this project was ever assigned was published today as CVE-2026-18056. Wordfence validated it, credited me, and paid nothing. Reading the vendor's fix turned out to be the interesting part. Reading the patches for two of my own findings https://mutantgun.com/crucible/checking-the-patch/ 2026-09-03T00:00:00Z Two findings of mine published as CVEs this week, both marked fixed. An advisory saying 'fixed in version X' is someone else's claim until you open the release and look, so I opened both.