Video Research Library
Recorded research from our isolated lab: real incidents we handled, rebuilt as harmless replicas, and critical vulnerabilities taken apart the week they are published. Each session shows what defenders should check and in what order. Exploits are never shown; every indicator in the lab is a synthetic placeholder.
One Cookie, Full Control: Responding to the Xen Orchestra Auth Bypass (VSA-2026-062)
A single forged cookie was enough to take over the virtualization control plane. We walk through exposure checks, the version trap, hunting on the Xen Orchestra server and the hosts, and the lockdown steps for today.
Watch the lab sessionOne Cookie, Full Control: Responding to the Xen Orchestra Auth Bypass (VSA-2026-062)
A single forged cookie was enough to take over the virtualization control plane. We walk through exposure checks, the version trap, hunting on the Xen Orchestra server and the hosts, and the lockdown steps for today.
Watch the lab session
The Backdoor That Grows Back: Taking Apart a Self-Healing WordPress Infection
A real cleanup where every deleted file came back within the hour. We rebuild the infection, map every hiding place from .user.ini to the database, and show the teardown order that actually makes it stay gone.
Watch the lab sessionNo sessions in this category yet. New sessions are added as we publish them.
Isolated lab, real structure
Every session runs on a disconnected lab. Real cases are rebuilt with the same file layout, persistence and triggers, with names, domains and payloads replaced by harmless stubs.
Defender first
We show detection, hunting and teardown order. We do not show exploitation. Advisories and official fixed versions are linked on every session page.
Minutes, not hours
Each video is cut to the steps that matter, with chapters, so you can jump straight to the check you need to run today.
Seeing something like this on your site or servers?
We clean infections, investigate how they persist and harden what we find. Fixed, published prices.