Hi, I'm Kirill 👋

Information Security Researcher · Software Engineer · Open Source Software Contributor

---

Blogs

• 2026-06-23 Why prompt injection works: a Transformer-level view
• 2026-06-04 Anatomy of Prompt Injection
• 2026-05-17 Build your own agentic framework — the no-magic version
• 2026-05-08 Your AI coding assistant is quietly shipping your secrets [1, 2]
• 2024-10-24 Reliable automatic code fixes with AI
• 2022-05-24 Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks
• 2022-04-04 Exploring 3 types of directory traversal vulnerabilities in C/C++
• 2022-01-10 Exploiting URL parser confusion
• 2021-06-02 Mitigating and remediating intent-based Android security vulnerabilities
• 2021-05-27 Hunting intent-based Android security vulnerabilities with Snyk Code
• 2021-05-18 Exploring intent-based Android security vulnerabilities on Google Play
• 2021-05-06 Deep dive into Visual Studio Code extension security vulnerabilities
• 2020-10-15 SourMint Malicious SDK Research write up
• 2020-03-26 Exploring the minimist prototype pollution security vulnerability
• 2016-12-07 Remote (dev)tools своими руками – интервью с Романом Дворновым (Авито)
• 2016-10-21 Дробим монолит: Рефакторинг архитектуры Web-приложений
• 2016-08-16 Запускаем Node.js на JVM
• 2012-02-06 MSP430, учимся программировать и отлаживать железо (часть 3)
• 2012-02-01 MSP430, учимся программировать и отлаживать железо (часть 2)
• 2012-01-09 MSP430, учимся программировать и отлаживать железо
• 2011-06-20 Amazon Route 53 и бесперебойная работа сайта

---

Talks

• 2025-05-30 OWASP 2025 Global AppSec EU: LLMs vs. SAST: How AI Delivers Accurate Vulnerability Detection and Reduces False Positives
• 2024-09-14 BSides Kraków: Don’t Make This Mistake: Painful Learnings of Applying AI in Security
• 2024-08-06 BSides Las Vegas: Don’t Make This Mistake: Painful Learnings of Applying AI in Security
• 2021-12-15 Log4Shell: What You Need to Know About the Log4j Vulnerability
• 2021-11-23 WeAreDevelopers JavaScript Congress 2021: Vulnerable VS Code extensions are now at your front door
• 2021-11-16 INTENT Summit: 1-click to infiltrate your org via vulnerable VS Code extensions
• 2021-11-03 Ekoparty 2021: 1-click to infiltrate your organization via vulnerable VS Code extensions
• 2021-06-02 I can use VS Code to hack into your development environment
• 2020-10-15 Security BSides Dublin: The Case Of Malicious Advertisement SDK Affecting Thousands Of Mobile Apps
• 2015-10-10 Учим linux вместе: Настройка окружения для написания модулей
• 2015-10-10 Учим linux вместе: Взаимодействие с proc fs
• 2015-09-19 Учим linux вместе: Как происходит загрузка ОС

---

Vulnerabilities

1. Open Redirect in Gophish
2. Path Traversal in Pistache CVE-2022-26068, C/C++
3. Path Traversal in Webcc CVE-2022-25298, C/C++
4. Arbitrary File Write in Drogon CVE-2022-25297, C/C++
5. Arbitrary File Write in Mongoose CVE-2022-25299, C/C++
6. Content Injection in Crow CVE-2021-23824, C/C++
7. Path Traversal in Crow CVE-2021-23514, C/C++
8. Arbitrary File Write in Iris Web Framework CVE-2021-23772, Go
9. Open Redirect in Clearance CVE-2021-23435, Ruby
10. DOM-based XSS in Video.js CVE-2021-23414, JavaScript
11. Open Redirect in Gitpod Go
12. Prototype Pollution in nedb CVE-2021-23395, JavaScript
13. Prototype Pollution in yargs-parser CVE-2020-7608, JavaScript
14. Prototype Pollution in minimist CVE-2020-7598, JavaScript
15. Denial of Service in ecstatic CVE-2019-10775, JavaScript
16. Command Injection in php-shellcommand CVE-2019-10774, PHP
17. SQL Injection in Medoo CVE-2019-10762, PHP
18. SQL Injection in Pixie Query Builder CVE-2019-10766, PHP
19. Prototype Pollution in AngularJS CVE-2019-10768, JavaScript
20. SQL Injection in knex.js CVE-2019-10757, JavaScript
21. SQL Injection in sequelize CVE-2019-10748, JavaScript
22. Prototype Pollution in lodash and lodash.merge CVE-2019-10744, JavaScript

---