> whoami

Application Security & Offensive Security

[ LAST SYNC ] June 2026

[ CHANNELS ]

LIVE TOPOLOGY NODE: AD-01

                  .--------.
             .---'          '---.
          .-'     [ 0xAD ]       '-.
        .'                            '.
       /       +----------------+       \
      /        |  AUTH GATEWAY  |        \
     ;         +-------+--------+         ;
     |                 |                  |
     |      .----------+----------.       |
     |      |                     |       |
     |   [ WEB ]               [ API ]    |
     |      |                     |       |
     |      '----------+----------'       |
     |                 |                  |
     ;          +------+-------+          ;
      \         |  TRUST: 00  |          /
       \        |  ACCESS: -- |         /
        '.      +-------------+       .'
          '-.        /_\          .-'
             '---.   \ /    .---'
                  '---+----'
                      |
                 [ HARDENED ]

MONITORING ATTACK SURFACE CTRL // 2026

[ 02 ]

About me

Operator profile // location, tooling, credentials, and selected output.

Location

COLOMBO / LK

Technologies

TOOLCHAIN / ACTIVE

Certifications

VERIFIED / 4

TryHackMe

Cisco

Anthropic

ISC2

Projects

OUTPUT

Ongoing / 2

Framework

PREFERRED

[ OPEN PROFILE ] Know more about me →

[ 03 ]

projects

Security tooling, research, and AI-assisted workflows most relevant to appsec and offensive security roles.

Project / 01

OPEN ↗

Leaflet

Pentest notes and engagement workspace with host tracking, findings, CVSS, credentials, and attack-chain documentation.

Project / 02

OPEN ↗

TeXploit

Local-first pentest report workspace for writing LaTeX or Markdown reports, managing findings, templates, and PDF compilation.

[ ALL SYSTEMS ] View projects →

[ 04 ]

Blogs

Selected security articles and CVE breakdowns I wrote for Xentrika Blog.

July 19, 2026 XENTRIKA / CVE INTEL

CVE-2026-63030 (wp2shell): One Bad REST Batch, One WordPress Shell

A CVSS 9.8 WordPress Core vulnerability chain lets unauthenticated attackers turn REST route confusion and SQL injection into remote code execution. Public PoCs are available, with early signs of in-the-wild activity reported.

July 13, 2026 XENTRIKA / CVE INTEL

CVE-2026-53359 (Januscape): The 16-Year-Old KVM Bug That Lets a Guest Own the Host

Januscape is a Linux KVM/x86 use-after-free that can turn nested virtualization into host-root code execution. Red Hat scores it CVSS 7.8; a host-crash PoC is public, while the full escape exploit remains withheld.

[ ARCHIVE ] View all blogs →

[ 05 ]

Open channel

Have a security problem, engineering role, or project worth discussing? Send a concise brief.