Home | hxuu

Hxuu

/hɛks uː/ • long story behind this name

I'm Anas! I'm a security researcher based in Algeria.

Welcome to my blog. You can read more about me here !

Latest posts

"CVE-2026-4006": How WP_Post's Magic Fallback Turned a Missing URL into Admin XSS

Most XSS bugs are obvious: unescaped input, wrong function, move on. This one wasn't. I dove into a conditional branch that only fires when an author has no URL, outputting data that absolutely shouldn't. This is a full technical walkthrough: from recon to PoC that takes a Contributor account to Admin XSS.

March 27, 2026
10 min read

bug-bounty write-up cves
"Apoorv 2k26": Tracking down makeki. Fun OSINT Challenge in the Midst of AI Slop

I dive into a multi-layered OSINT (Open-Source Intelligence) investigation that proves the "old days" of manual, high-dopamine digital sleuthing are far from over in this AI dominated time.

March 17, 2026
6 min read

ctf write-up apoorv

See all posts →