Coolify: Host-Level RCE via Unescaped Database Credentials in Backup Jobs
How an incomplete security fix in Coolify left 5 credential fields injectable in database backup commands, allowing root-level RCE on all managed servers.
Read More →Cybersecurity researcher & full-stack developer with a passion for breaking things to make them stronger. Based in Riyadh, contributing to digital security.
A security researcher by day, a developer by passion
I'm a cybersecurity engineer based in Riyadh with 10+ years in offensive security. I break things for a living, and I've found 15+ zero-days in platforms like Coolify, GLPI, Portainer, and n8n.
I also build AI agents for security testing. My latest project is a multi-agent system that handles recon, vulnerability hunting, and reporting on its own. Think of it as giving AI a pentester's brain.
OSCP, BSCP, HTB CWEE certified. MSc in Cybersecurity from Liverpool. My dissertation, TrustChain, uses machine learning to catch malware through certificate reputation analysis.
Critical vulns in Coolify, GLPI, Portainer, n8n
Built AI agents that find real vulnerabilities
Elite offensive security certifications
Security research, web development, and open-source contributions
Security scanning platform I built. 10+ scanners for SQLi, XSS, SSRF, XXE, and more. AI layer filters out false positives. Generates clean PDF reports.
Full-stack meal voucher management system for Boudl Hotels chain. QR-based validation with real-time tracking and multi-property support. Live at qr.boudl.com
Discovered and responsibly disclosed 15+ critical vulnerabilities across Coolify, GLPI, Portainer, n8n, SuiteCRM, Piwigo, and others. Including RCE (CVSS 9.1), SSRF, SQLi, and auth bypass chains.
A system of 6 AI agents that work together to find security vulnerabilities. Handles recon, hunting, exploit writing, and reporting. Found real critical bugs with it.
Tools & technologies I work with daily
Thoughts on security, development, and the digital landscape
How an incomplete security fix in Coolify left 5 credential fields injectable in database backup commands, allowing root-level RCE on all managed servers.
Read More →Static MD5 auth tokens, unrestricted .htaccess uploads, and four unsafe unserialize() calls chain together for full server compromise.
Read More →Have a project in mind? Let's discuss how I can help.