Request an assessment

// proof over claims

Published research, visible evidence.

The credibility behind every engagement comes from public vulnerability research, coordinated disclosure and verifiable evidence in AI infrastructure, firmware and cryptography. The same researcher does your monthly AI security testing.

Post-quantum cryptoCVE-2026-41509 · CVSS 9.8
CVE-2026-41509 on NVD
Mbed TLSCVE-2026-34877 · CVSS 9.8
CVE-2026-34877 on NVD
Lenovo BIOS / SMMCVE-2026-10589 · code execution
CVE-2026-10589 Lenovo SMM on CVE.org
vLLM inference serverCVE-2026-105758 · memory exhaustion
CVE-2026-105758 vLLM record

10 published CVEs 4 Mbed TLS · 4 Lenovo SMM · 1 CROSS PQC · 1 vLLM 6 fixes authored and merged upstream · 7 merged by maintainers from reported findings All disclosures, with links →

Where the findings landed

LenovoInsydeH2O BIOS: SMM handler buffer validation, SMRAM address leak, missing handler authentication, ring -2 code execution.4 CVEs
Mbed TLSSerialized-session memory safety, FFDH key handling, CCM out-of-bounds read, ECDH buffer overflow.4 CVEs · up to 9.8
CROSSPost-quantum signature reference implementation: integer underflow to buffer overflow in signature opening.CVE-2026-41509 · 9.8
oqs-providerDouble-free and NULL-check defects in the Open Quantum Safe OpenSSL provider; fixes authored and merged upstream (PR #766, PR #767).2 advisories · fixes merged
SNOVAPost-quantum signature reference implementation: lookup tables read before initialization in public-key expansion, and an oversized bound in signature verification; fixes authored and merged into the official source (PR #15).2 fixes merged
liboqsLMS stateful signatures: verification did not bind the signature and public key to the parameter set in use. Reported publicly in issue #2568, credited as an independent report in the joint advisory (GHSA-xv6c-h66p-6mfq).CVE-2026-104255 assigned · co-credited
Linux kernelaccel/amdxdnaAMD NPU driver: a mailbox channel pointer left dangling after a failed start (use-after-free on the restart path), merged into mainline for Linux 7.4; and an unbounded sync_bo flush range, fixed in the 6.18 longterm branch (Linux 6.18.57). Patches authored.2 fixes merged
AMDNPU kernel driver IOCTL out-of-bounds access, buffer overflow, WMI SMI injection, AMDKFD stack out-of-bounds.4 accepted
IntelInteger overflows, OpenVINO deserialization, TensorFlow SavedModel parsing.5 accepted
ARMTrusted Firmware: TF-A, TF-M, OP-TEE and Mbed TLS (SM2 KEP, ECDH overflows, FF-A, PSA PAKE, SDEI).8 accepted
TF-RMMTrustedFirmware.orgSource-level audit of device assignment in the Arm CCA Realm Management Monitor: 15 findings reported to the TF-RMM security team, seven fixes merged upstream with a Reported-by credit.15 reported · 7 merged
VMwareXXE injection in VGAuth SAML handling.1 accepted
RootstockPowHSM Merkle-proof verification bypass in sidechain federation key management.1 bounty (Immunefi)
vLLMInference server: the Qwen2-VL and Qwen3-VL video samplers bound on a request-controlled frame count the server-side ceiling does not reach, so one unauthenticated request to /tokenize exhausts API-server memory. Fixed in v0.30.0 (GHSA-x6mc-67gf-chw4).CVE-2026-105758
AnythingLLMAnonymous embed-widget visitors received the instance owner's private memories in the system prompt (GHSA-8wh8-3v68-whwj).published advisory
AI/ML toolingUnsafe deserialization, model-loading flaws, SSRF, path traversal and memory-safety issues across PyTorch, TensorFlow, OpenVINO, ExecuTorch and TVM.coordinated disclosures

// source-level audits

Deep audits, scoped to your code.

For teams that need a one-off source-level review of AI infrastructure, firmware or cryptography. A written scope and a fixed price before any work starts. Every finding is written up at advisory grade: the same standard the published CVEs had to meet.

[ ai infrastructure ]

AI Infrastructure Audit

Source review and live testing of the layer your AI product runs on: inference servers, LLM gateways, application platforms, RAG pipelines, agents and MCP integrations, accelerator runtimes.

2-4 weekstypical engagement window
  • request parsing, multi-tenant cache and session isolation, resource exhaustion
  • prompt and retrieval paths: cross-user exposure, injection, output handling
  • agents and MCP: tool permissions, memory, multi-step attack chains
  • penetration testing of the web and API layer around the model, with authenticated roles
Scope & deliverables→ Request an audit →
[ firmware · accelerators ]

Firmware & Accelerator Audit

Implementation review of boot-chain firmware, privileged handlers and the drivers that sit between an AI workload and the hardware.

3-4 weekstypical engagement window
  • UEFI/SMM handlers, SMRAM and communication-buffer validation
  • ARM TrustZone, TF-A/TF-M, OP-TEE and secure-boot chains
  • NPU and GPU driver IOCTLs, DMA and shared-memory boundaries
  • firmware image parsing and update paths
Scope & deliverables→ Request an audit →
[ cryptography · pqc ]

Cryptography & PQC Audit

Review of cryptographic implementations and the code around them: the area behind most of the published CVEs.

3-4 weekstypical engagement window
  • post-quantum implementations: signatures, KEMs, stateful hash-based schemes, hybrids
  • TLS stacks: handshake state, key handling, serialization
  • signature verification and secure-boot integration
  • error paths, length handling and parser edge cases
Scope & deliverables→ Request an audit →
[ retained research ]

Retained research

For teams that ship security fixes continuously: a monthly research retainer covering variant analysis of the security fixes you merge, watch on the upstream projects you depend on, and a written advisory for anything that turns up. Scope is sized to your codebase, and you can cancel on one month’s notice. Ask about a retainer →

[ included with every audit ]

What you receive

  • The report. Confirmed scope, methodology, findings with reproducible proof of concept, CVSS with rationale, written remediation, and a coverage table of what was and was not examined.
  • An executive summary written for a reader who will not open the technical section.
  • One asynchronous retest within 60 days.
  • Coordinated disclosure handled with the vendor or CNA where a finding belongs upstream.

Written to be handed straight to whoever asked for it: security questionnaires, SOC 2 or ISO 27001 evidence, ISO/IEC 42001 and NIST AI RMF work, procurement or investor review.

[ the deliverable ]

This is what lands in your inbox

A published audit, whole and unredacted: the finding traced from source to impact, with the evidence that proves it.

Read the full report (PDF) →

Cover page of an XSource Security audit report The coverage table from an XSource Security audit report
[ public audit reports ]

Every public report, whole and unredacted

New reports appear here as they publish.

GHSA-8wh8-3v68-whwj AnythingLLM: owner's private Memories disclosed to anonymous embed-widget visitors Mintplex Labs · AI Infrastructure
Full report (PDF) ↗
CVE-2026-10587, CVE-2026-10588, CVE-2026-10589, CVE-2026-10590 Lenovo notebook BIOS, SMM handler validation Lenovo · Firmware & Accelerator
Full report (PDF) ↗
CVE-2026-41509 CROSS post-quantum signature buffer overflow CROSS · Cryptography & PQC
Full report (PDF) ↗