Skip to content
View privlabs's full-sized avatar

Block or report privlabs

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
privlabs/README.md

Nelson Adhepeau — Security Researcher / Security Engineer

I work on early security risk analysis: supply-chain trust, update mechanisms, configuration assumptions — before scanning or exploitation.

Current focus

  • Supply-chain security & trust boundaries
  • Linux & infrastructure security
  • CMS & firewall update mechanisms
  • Incident response & root cause analysis

CVE Publications

CVE CVSS Description Status
CVE-2025-69691 9.9 Critical Authenticated RCE via XMLRPC exec_php — Netgate pfSense CE 2.8.0 Published
CVE-2025-69690 8.8 High Authenticated RCE via unsafe deserialization — Netgate pfSense CE 2.7.2 Published

Official records & government validation:

Research

Tools & Documentation

Follow & Contact

Pinned Loading

  1. CVE-2025-69690-CVE-2025-69691 CVE-2025-69690-CVE-2025-69691 Public

    Authenticated RCE in Netgate pfSense CE 2.7.2 and 2.8.0

  2. -Supply-Chain-Attack-Simulation-on-Drupal-RCE-via-Malicious-Update-Server-PoC-not-a-CVE- -Supply-Chain-Attack-Simulation-on-Drupal-RCE-via-Malicious-Update-Server-PoC-not-a-CVE- Public

    1

  3. early-security-risk-analysis early-security-risk-analysis Public

  4. lpe-cron-misconfig-2025 lpe-cron-misconfig-2025 Public

    Research on privilege escalation via cron job misconfigurations in enterprise Linux. Audit scripts, hardening, and attack/defense guide.

    Shell