Research / PaxDynamics

Articles

Technical investigations and engineering notes from work in software, AI, data systems, and security.

Move to explore

Latest Posts07

One byte past the buffer

A local lab record of an out-of-bounds write in PHP mbstring's SJIS-mac substring path: ASAN evidence on 8.4.27, stock-build observations, prior art, and limits.

Oct 31, 202611 min

PHP Security

What the failed tests taught us

Part 3: the leak search, the version matrix, the magic-method negatives, the Redis format mismatch, and the FPM and architecture limits of this PHP research.

Oct 31, 20267 min

Security PHP

The session decoder was the sink all along

Technical record for the PHP session-decoder and var_destroy lab chain: test sequence, controls, prior art, and deployment limits.

Oct 31, 202621 min

PHP Security

Following the chain into application code

Part 2: Drupal, Joomla, Roundcube, and WordPress, and the exact conditions that separate a loaded gadget from a working PHP session chain.

Oct 31, 20268 min

PHP Security

The destructor path that survived the patch

Part 1: what PHP's October security releases fixed, and how a different var_destroy path still reached freed memory on PHP 8.4.27 and 8.5.12.

Oct 31, 20266 min

AI Startups Product Reflection

All roads led to Markdown

A startup-builder loop through CEOgenerator, Framepath, Paperclip governance, Paxlings, and the awkward realization that Build Right was the markdown harness.

Jun 24, 202610 min