NEWS > Research Blog
October 09, 2026
A Container in a Pod Is Not a Security Boundary - Lateral Movement into Envoy Sidecars
We turned Envoy's hot-restart shared memory file into an ASLR leak and an arbitrary write. The maintainers said it's not a security issue. We think that is only half the story when you run it on Kubernetes.
October 07, 2026
X41 Audited vLLM
X41 releases the audit report of vLLM
October 07, 2026
BadHost: Discovery and Details
We describe how we found the issue, explain the vulnerability in detail, and go over its impact, the disclosure, and publication process.
September 21, 2026
Advisory X41-2026-004: dm-verity can be bypassed in Debian live-boot
X41 discovered that dm-verity can be bypassed in Debian live-boot
July 14, 2026
X41 Audited NLnet Labs Routinator
X41 releases the audit report of NLnet Labs Routinator
May 22, 2026
Advisory X41-2026-002: Request Host Header not Validated in Starlette
Missing Host header validation leads to misleading URL path in Starlette
April 21, 2026
X41 Reviewed SecureDrop
X41 releases the audit report of SecureDrop.
April 08, 2026
Advisory X41-2026-001: Guardrail Sandbox Escape in LiteLLM
Advisory for a sandbox escape vulnerability in LiteLLM
April 02, 2026
Review of AzireVPN and Malwarebytes Privacy VPN
X41 releases the audit report of Malwarebytes AzireVPN
January 20, 2026
X41 Audited Mullvad VPN AB API
X41 releases the audit report of Mullvad VPN AB's API and connected services
January 13, 2026
X41 Audited CRI-O Runtime
X41 releases the audit report of CRI-O
December 19, 2025
Happy Holidays
Year Overview & Happy Holidays!
November 12, 2025
X41 BeanStack - Java Fingerprinting Database Updated
We updated beanstack - our Java fingerprint database
September 25, 2025
Is Mouse Input Random Enough for Generating Secret Keys?
Mouse movement events were found to have enough random variation to be usable as the only source of randomness for generating a secure cryptographic key.
September 05, 2025
Advisory X41-2025-002: DoS Vulnerability in ntpd-rs
Eric Sesterhenn of X41 discovered a DoS vulnerability in ntpd-rs
September 03, 2025
Advisory X41-2024-004: Missing Transport Security for Medico Classic Application Server Connections
Niklas Abel and Luc Gommans of X41 discovered a Vulnerability in Medico
September 03, 2025
Advisory X41-2024-004: Missing Transport Security for Medico Classic Application Server Connections
Niklas Abel and Luc Gommans of X41 discovered a Vulnerability in Medico
July 29, 2025
Research Week
Small tools and notes from X41's 2025 internal research week
June 11, 2025
X41 Audited Ruby on Rails
X41 releases the audit report of Ruby on Rails.
May 22, 2025
X41 Audited nghttp3 and ngtcp2
X41 releases the audit report of nghttp3 and ngtcp2.
