Mutantgun
Independent projects in security and software — the method, the measurements, and what they actually cost.
Projects
-
Crucible Active
Vulnerability research against the WordPress plugin ecosystem, disclosed through the channels that assign CVE identifiers.
-
Side Quests Active
Problems I picked up because they had been nagging at me, worked on properly, and wrote down honestly — including the parts that went nowhere.
Recent updates
-
Side Quests
Already in a 2012 table
Over about three days, plus two days of follow-up work, an AI system working under my direction verified that every start up to 7.0·10^13 in the 3x − 1 problem falls into one of three known loops. That range is 32 to 13,000 times smaller than the largest that others report or imply. The result I treated as a finding, that the loop through 17 collects more numbers than the other two (34.8 % of those below 2^34), was already in exact counts in a 2012 Hamburg preprint; what survived my limited literature search is a pre-registered test showing the race is settled among small numbers, and two patterns I can't place.
-
Crucible
A prediction I read back as a fact
Wordfence refused this report. WPScan published it as a CVE. I was carrying a written rule that predicted what that refusal would cost me, the rule was wrong, and my own review handed the prediction back as though somebody had measured it. What settled it was logging in and reading the figure off their page.
-
Crucible
Fixed in 1.6.5
A CVE of mine published today. Days earlier I'd concluded in writing that its affected range was wrong and a correction was owed to the coordinating body. I'd compared the wrong pair of releases.
-
Crucible
Six figures, and why that is not the first time
CVE-2026-100070 published at 13:06 UTC today — the first six-figure identifier of 2026. Six-figure CVE IDs have existed since 2014, though, and the difference between those and this one is the whole story.
-
Crucible
One bug, three plugins
A CVE published today covers three plugins at once, because all three ship the same bundled file manager. Fifteen days separated the first vendor's fix from the last, and the advisory published two days after that.
-
Crucible
Out of scope, then a CVE in a day
A CVE published today for a report the first venue refused. They'd stopped accepting the whole class of bug. The real failure wasn't that I skipped a check, it's that my scope model had no way to notice a venue moving.
-
Crucible
The next one paid $135
My second Wordfence CVE published today. It paid $135, which is the first money this project has ever earned. Two numbers explain most of the difference between this one and the first, which paid nothing, but not all of it. The advisory also corrected something I'd assumed about what a severity score encodes.
-
Crucible
First to file, and still a duplicate
Three days before my report was closed as a duplicate, the venue told me it was validated, confirmed against the source, and queued for vendor coordination. Working out how both of those were true turned out to be worth more than the record.
-
Crucible
My first CVE, and it paid nothing
The first CVE this project was ever assigned was published today as CVE-2026-18056. Wordfence validated it, credited me, and paid nothing. Reading the vendor's fix turned out to be the interesting part.
-
Crucible
Reading the patches for two of my own findings
Two findings of mine published as CVEs this week, both marked fixed. An advisory saying 'fixed in version X' is someone else's claim until you open the release and look, so I opened both.