How a PDF button became remote code execution (and paid for my year)
February 28, 2023A fictionalized writeup of the best bug I ever found: an 'export to PDF' feature that, five hops later, was running my code inside someone else's cluster. Target anonymized, chain real-in-spirit.