We research the 1-day
The 1-day is the interval between a patch landing and widespread exploitation - defenders racing to deploy, attackers racing to reverse-engineer. We sit in the middle: analyzing, documenting, publishing.
Not a patch-diff feed. We turn CVE claims into evidence and go past the single bug to the techniques behind it - and we are building a community of practitioners to share methods and argue findings in public.
ÂLIM analyses CVEs on its own.
ÂLIM is our AI-driven analysis engine. Point it at a disclosed CVE in open-source software and it works the flaw end to end without an analyst driving each step: it studies the vulnerability, rebuilds it in an isolated containerised lab, develops a working proof-of-concept, and validates that exploit against both the vulnerable and the patched build.
That last part is the point. A result is only reported once the exploit has been shown to fire on the unpatched build and to stop working on the fixed one - so what we publish is demonstrated, not asserted.
The latest from the lab.
Each write-up follows a disclosed CVE from the patch to the root cause in the source, and ends with a proof-of-concept we have actually run - against the vulnerable build and the fixed one. The full archive lives in the blog.
| 2026-10-13 | CVE-2026-87930 | CVE-2026-87930 Exploit: MaxSite Object Injection RCE | PoC | |
| 2026-10-12 | CVE-2026-97229 | CVE-2026-97229 Exploit: GitLab CI Regexp RCE | PoC | |
| 2026-10-12 | CVE-2026-107645 | CVE-2026-107645 Exploit: Blocksy Companion Privilege Escalation | PoC |
Found something? Want to publish with us?
Send us a write-up, a CVE worth analysing, or a correction to something we published - corrections are welcome and credited. For sensitive reports, use our PGP key. If you would like to support the project, the same address reaches us.