Currently in preview | The website is subject to change.

IDNSEC
ENID Contact

Cybersecurity
research

Collective offensive, defensive, and engineering research.

FEATURED

A split cite attribute value with an injected paragraph tag, over a dark mesh gradient

FEATURED

Comment2Shell: Zero-Click Pre-Auth XSS to RCE in WordPress Core

A comment from an anonymous visitor could turn into stored XSS, and eventually RCE, on a WordPress site running a block theme, because wpautop() swaps a newline inside an HTML attribute value for an HTML comment, and its blockquote rewrite then mistakes that comment's closing bracket for the end of the tag. Fixed in WordPress 7.1.1 as CVE-2026-93485.

RAFIE MUHAMMADREAD RESEARCH →

Research

Hacking Campaign and SEO Cloaking of Indonesian Illegal Gambling

A case study of the tactics, techniques, and procedures of Cybercrime-as-a-Service that fuels the marketing channel for Indonesia's billion-dollar illegal gambling industry.

EMYRA

General

An impressionist red-and-white composition

Introducing IDNSEC

Promoting cybersecurity research and engineering culture in Indonesia.

FARISKHI VIDYAN