{
  "meta": {
    "updated": "2026-10-13",
    "source": "https://rxerium.com/about/",
    "canonical": "https://rxerium.com/about/"
  },
  "profile": {
    "name": "Rishi",
    "alias": [
      "rxerium",
      "@rxerium"
    ],
    "role": "Security Researcher",
    "location": "London, UK",
    "bio": "Vulnerability researcher and threat intelligence specialist based in London, UK. Security Researcher at The Shadowserver Foundation and part of the executive leadership of the UK OSINT community. Detection research recognised by governments across North America, Europe, and Asia, and trusted by national cyber authorities and law enforcement. Multi-time DEF CON and BSides speaker; briefed the UK Government and policymakers on risks to critical infrastructure and the software supply chain. Committed open-source contributor authoring detection tooling relied upon by defenders worldwide.",
    "socials": [
      {
        "label": "GitHub",
        "url": "https://github.com/rxerium"
      },
      {
        "label": "X (Twitter)",
        "url": "https://x.com/rxerium"
      },
      {
        "label": "LinkedIn",
        "url": "https://linkedin.com/in/rxerium"
      },
      {
        "label": "Bluesky",
        "url": "https://bsky.app/profile/rxerium.com"
      },
      {
        "label": "Mastodon",
        "url": "https://infosec.exchange/@rxerium"
      },
      {
        "label": "Discord",
        "url": "https://discord.com/users/1015266410332700755"
      },
      {
        "label": "Signal",
        "url": "https://signal.me/#eu/0Qd68U1ivXNdWCF4hf70UYFo7tB0w-GQqFpYcyV6-yr4exn2SclB6bFeP7wTAxQw"
      }
    ],
    "email": "rishi@rxerium.com"
  },
  "heroStats": [
    {
      "value": "950+",
      "label": "nuclei templates"
    },
    {
      "value": "20+",
      "label": "conference talks"
    },
    {
      "value": "7",
      "label": "gov & cert citations"
    },
    {
      "value": "11",
      "label": "cves disclosed"
    }
  ],
  "experience": [
    {
      "org": "The Shadowserver Foundation",
      "role": "Security Researcher",
      "dates": "Jan 2026 — Present",
      "bullets": [
        "Engineering detection signatures and internet-wide scans",
        "Turning honeypot data into actionable detections",
        "Supporting government cyber response",
        "Equipping CSIRTs with exposure data"
      ]
    },
    {
      "org": "UK OSINT",
      "role": "Executive Leadership",
      "dates": "Mar 2025 — Present",
      "bullets": [
        "Strengthening sovereign UK intelligence capability",
        "Produces high-quality OSINT educational content",
        "Organises and hosts OSINT events across the UK"
      ]
    },
    {
      "org": "KYND",
      "role": "Senior Security Researcher — London",
      "dates": "Feb 2022 — Aug 2026",
      "bullets": [
        "Led enterprise vulnerability research",
        "Architected an internet-wide platform scanning millions of assets",
        "Authored advisories translating CVE, CVSS and EPSS data into business risk"
      ]
    },
    {
      "org": "ECC",
      "role": "First Line Support Engineer",
      "dates": "Jan 2020 — Aug 2021",
      "bullets": [
        "Delivered network and endpoint support within SLA across 500 customers",
        "Led Windows 10 migration and MFA rollout to 2000 endpoints",
        "Maintained EPP/MDR, Active Directory and O365 / Google Workspace"
      ]
    }
  ],
  "affiliations": [
    {
      "org": "ProjectDiscovery Pioneer",
      "dates": "Oct 2024 — Present",
      "bullets": [
        "Authored 950+ Nuclei detection templates used worldwide",
        "Shapes PD Cloud through beta testing and product guidance",
        "Authors technical blog content for ProjectDiscovery"
      ]
    },
    {
      "org": "OWASP Member",
      "dates": "Feb 2025 — Present",
      "bullets": [
        "Contributes to Amass, OWASP's attack surface framework",
        "Contributes to Nettacker, an automated recon framework",
        "Supported the OWASP Amass workshop at DEF CON 33"
      ]
    }
  ],
  "recognition": {
    "government": [
      {
        "org": "NCSC (UK Government)",
        "action": "Recognised detection script for GoAnywhere MFT exploitation.",
        "refs": ["CVE-2025-10035"]
      },
      {
        "org": "CERT Polska",
        "action": "Adopted detection scripts into Artemis tooling.",
        "refs": ["CVE-2025-49113", "CVE-2025-68461"]
      },
      {
        "org": "California Cyber Security Integration Center",
        "action": "Cited detection in an official cyber advisory.",
        "refs": ["CVE-2025-10035"]
      },
      {
        "org": "NIST / NVD",
        "action": "Featured detection script on the official advisory page.",
        "refs": ["CVE-2023-40000"]
      },
      {
        "org": "Spanish Government Agency (INCIBE)",
        "action": "Referenced detection script in national guidance.",
        "refs": ["CVE-2023-40000"]
      },
      {
        "org": "CIRCL (Luxembourg)",
        "action": "Referenced vulnerability research across advisories.",
        "refs": ["research"]
      },
      {
        "org": "Gov. of Vietnam",
        "action": "Cited detection work in national advisories.",
        "refs": ["advisories"]
      }
    ],
    "industry": [
      {
        "category": "vendor citations",
        "detail": "Detection research cited across vendor advisories and threat reports.",
        "orgs": ["SonicWall", "Censys", "Black Kite", "Qualys", "ReSecurity", "Coalition", "Intruder", "Feedly", "Positive Technologies", "DarkWebInformer"]
      },
      {
        "category": "ctf",
        "org": "BSides Las Vegas",
        "detail": "Won the ProsVJoes capture-the-flag competition.",
        "date": "Aug 2025"
      }
    ],
    "press": [
      {
        "org": "GBHackers",
        "url": "https://gbhackers.com/poc-released-oracle-e-business-suite-0-day/"
      },
      {
        "org": "The Hacker News",
        "url": "https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html"
      },
      {
        "org": "Cybersecurity News",
        "url": "https://cybersecuritynews.com/issabel-pbx-command-execution-vulnerability/"
      },
      {
        "org": "Security Online",
        "url": "https://securityonline.info/issabel-pbx-vulnerability-exploited/"
      },
      {
        "org": "CyberPress",
        "url": "https://cyberpress.org/issabel-pbx-jwt-key-flaw/"
      },
      {
        "org": "+7 more outlets",
        "url": null
      }
    ],
    "media": [
      {
        "org": "SANS Stormcast",
        "url": "https://isc.sans.edu/podcastdetail/10100"
      },
      {
        "org": "SecurityIntel",
        "url": "https://buttondown.com/SecurityIntel/archive/securityintel-17-sep-first-agentic-ai-data-breach/"
      },
      {
        "org": "Exploit Bulletin",
        "url": "https://buttondown.com/exploit-bulletin/archive/the-exploit-bulletin-wednesday-september-16-2026/"
      }
    ]
  },
  "research": [
    {
      "kicker": "research post",
      "title": "Detecting OpenClaw Gateways with Nuclei over mDNS",
      "url": "https://rxerium.com/posts/hunting-exposed-openclaw-instances-with-nuclei/",
      "date": "Jan 2026"
    },
    {
      "kicker": "research post",
      "title": "Salesloft Drift Supply Chain Detection through DNS OSINT Techniques",
      "url": "https://rxerium.com/posts/dns-osint-techniques/",
      "date": "Dec 2025"
    },
    {
      "kicker": "research post",
      "title": "Internal Security Detection from an External Lens",
      "url": "https://rxerium.com/posts/internal-security-detection/",
      "date": "Jun 2025"
    },
    {
      "kicker": "research post · osint.uk",
      "title": "Ethical Implications of OSINT in Personal Data Collection",
      "url": "https://www.osint.uk/content/ethical-implications-of-osint-in-personal-data-collection",
      "date": "Apr 2025"
    },
    {
      "kicker": "research post · ProjectDiscovery",
      "title": "Fishing for Phishing with Nuclei Templates",
      "url": "https://projectdiscovery.io/blog/phishing-templates",
      "date": "Mar 2024"
    },
    {
      "kicker": "interview · ProjectDiscovery",
      "title": "Project Discovery Interview",
      "url": "https://projectdiscovery.io/blog/community-spotlight-rishi-rxerium",
      "date": "Jul 2026"
    }
  ],
  "projects": [
    {
      "name": "rxerium-templates",
      "flagship": true,
      "description": "Open-source Nuclei detection templates for critical CVEs — battle-tested CVE detections used worldwide, from phishing infrastructure to critical RCE.",
      "url": "https://github.com/rxerium/rxerium-templates",
      "stats": {
        "templates": "950+",
        "mergedUpstreamPRs": 157,
        "pioneerRank": "7th global pioneer"
      },
      "tags": ["nuclei", "cve detection", "phishing", "rce"]
    },
    {
      "name": "CISA-KEV",
      "flagship": false,
      "description": "Automated tracking of Nuclei template scanning capabilities against CISA's Known Exploited Vulnerabilities catalog.",
      "url": "https://github.com/rxerium/CISA-KEV",
      "tags": ["nuclei", "cisa kev", "automation"]
    },
    {
      "name": "cms-exploitation-campaign",
      "flagship": false,
      "description": "Large-scale exploitation campaign against CMS devices reported in July 2026.",
      "url": "https://github.com/rxerium/cms-exploitation-campaign",
      "tags": ["threat intel", "cms", "honeypots"]
    },
    {
      "name": "ai-bot-ip-ranges",
      "flagship": false,
      "description": "Official IP ranges for AI bot crawlers — OpenAI, Anthropic, Google, Microsoft, Perplexity. Weekly auto-updates.",
      "url": "https://github.com/rxerium/ai-bot-ip-ranges",
      "tags": ["osint", "ip ranges", "ai bots"]
    },
    {
      "name": "responsible-disclosure-email-gathering",
      "flagship": false,
      "description": "Workflow to gather responsible disclosure emails from given hosts.",
      "url": "https://github.com/rxerium/responsible-disclosure-email-gathering",
      "tags": ["disclosure", "automation", "osint"]
    },
    {
      "name": "OWASP Amass (contributor)",
      "flagship": true,
      "description": "Contributing to OWASP's attack surface discovery framework used by defenders worldwide, and supported the Amass workshop at DEF CON 33.",
      "url": "https://github.com/owasp-amass/amass",
      "tags": ["go", "attack surface", "dns", "osint"]
    }
  ],
  "cves": {
    "summary": {
      "total": 11,
      "critical": 3,
      "high": 8
    },
    "items": [
      {
        "id": "CVE-2026-89026",
        "year": 2026,
        "severity": "critical",
        "cvss": 9.8,
        "product": "Issabel Framework / Issabel PBX",
        "type": "hardcoded JWT key → RCE",
        "description": "Identical hard-coded HS256 JWT signing key across every install allows unauthenticated attackers to forge bearer tokens and invoke the manager originate endpoint for remote command execution. Exploited in the wild.",
        "cwe": "CWE-321"
      },
      {
        "id": "CVE-2023-54399",
        "year": 2023,
        "severity": "critical",
        "cvss": 9.8,
        "product": "Hongjing e-HR < 8.2",
        "type": "SQL injection · unauthenticated",
        "description": "UNION SELECT injection via the categories parameter on /servlet/codesettree exposes arbitrary database content including credential tables.",
        "cwe": "CWE-89"
      },
      {
        "id": "CVE-2023-54400",
        "year": 2023,
        "severity": "critical",
        "cvss": 9.8,
        "product": "Fumasoft Fumeng Cloud",
        "type": "SQL injection · unauthenticated",
        "description": "UNION-based injection through the Name parameter of the getEmpByname action on AjaxMethod.ashx against a MSSQL backend — read and modify database contents.",
        "cwe": "CWE-89"
      },
      {
        "id": "CVE-2024-58388",
        "year": 2024,
        "severity": "high",
        "cvss": 7.5,
        "product": "Sharp / Toshiba Tec MFPs",
        "type": "local file inclusion",
        "description": "Directory traversal via the path parameter on installed_emanual_down.html reads arbitrary files outside the manual directory.",
        "cwe": "CWE-22"
      },
      {
        "id": "CVE-2024-58387",
        "year": 2024,
        "severity": "high",
        "cvss": 7.5,
        "product": "Inspur Haiyue HCM Cloud",
        "type": "arbitrary file read",
        "description": "Unvalidated index / ext parameters on /api/model_report/file/download traverse the filesystem and disclose sensitive files such as /etc/passwd.",
        "cwe": "CWE-22"
      },
      {
        "id": "CVE-2023-54403",
        "year": 2023,
        "severity": "high",
        "cvss": 7.5,
        "product": "Yonyou U8 CRM < V16.5 / V18",
        "type": "arbitrary file read · auth bypass",
        "description": "DontCheckLogin=1 bypass plus unvalidated filePath on /ajax/getemaildata.php reads config files and other sensitive paths outside the web root.",
        "cwe": "CWE-22"
      },
      {
        "id": "CVE-2023-54402",
        "year": 2023,
        "severity": "high",
        "cvss": 7.5,
        "product": "iDocView",
        "type": "SSRF → local file read",
        "description": "Hard-coded default token (testtoken) bypasses auth on /doc/upload; unrestricted URL schemes including file:// expose local OS and app files.",
        "cwe": "CWE-918"
      },
      {
        "id": "CVE-2021-48008",
        "year": 2021,
        "severity": "high",
        "cvss": 7.5,
        "product": "Chanjet CRM",
        "type": "SQL injection · unauthenticated",
        "description": "UNION-based injection via the site_id parameter on the webservice endpoint extracts sensitive data from the backend database.",
        "cwe": "CWE-89"
      },
      {
        "id": "CVE-2019-25776",
        "year": 2019,
        "severity": "high",
        "cvss": 7.5,
        "product": "Weaver E-cology",
        "type": "SQL injection · unauthenticated",
        "description": "UNION injection through userIdentifiers on the mobile plugin endpoint, bypassing space-based filters to dump admin credentials and sensitive rows.",
        "cwe": "CWE-89"
      },
      {
        "id": "CVE-2017-20284",
        "year": 2017,
        "severity": "high",
        "cvss": 7.5,
        "product": "Caucho Resin (resin-doc)",
        "type": "path traversal",
        "description": "Relative-path input through inputFile on the jndi-appconfig tutorial servlet reads arbitrary files outside the documentation webapp.",
        "cwe": "CWE-22"
      },
      {
        "id": "CVE-2015-20122",
        "year": 2015,
        "severity": "high",
        "cvss": 7.5,
        "product": "Seeyon A6 OA",
        "type": "SQL injection · unauthenticated",
        "description": "UNION injection via attach_ids on downloadAtt.jsp dumps arbitrary database content with no authentication required.",
        "cwe": "CWE-89"
      }
    ]
  },
  "speaking": {
    "summary": {
      "sessions": 19,
      "sessionsDisplay": "20+",
      "workshops": 2,
      "countries": 8,
      "byYear": {
        "2025": 4,
        "2026": 15
      }
    },
    "talks": [
      {
        "title": "DNS OSINT Techniques for Product and Service Discovery",
        "event": "DEF CON 33 Red Team Village",
        "location": "Las Vegas, Nevada, USA",
        "date": "2025-08",
        "type": "talk"
      },
      {
        "title": "DNS OSINT Techniques for Product and Service Discovery",
        "event": "BSides Cymru",
        "location": "Cardiff, Wales, UK",
        "date": "2025-10",
        "type": "talk"
      },
      {
        "title": "DNS OSINT Techniques for Product and Service Discovery",
        "event": "BSides Porto",
        "location": "Porto, Portugal",
        "date": "2025-11",
        "type": "talk"
      },
      {
        "title": "Security Research Briefing",
        "event": "UK Government Briefing",
        "location": "London, UK",
        "date": "2025-12",
        "type": "briefing"
      },
      {
        "title": "DNS OSINT Techniques for Product and Service Discovery",
        "event": "OWASP London",
        "location": "London, UK",
        "date": "2026-01",
        "type": "talk"
      },
      {
        "title": "DNS OSINT Techniques for Product and Service Discovery",
        "event": "BSides Prague",
        "location": "Prague, Czech Republic",
        "date": "2026-04",
        "type": "talk"
      },
      {
        "title": "AI-Driven Vulnerability Apocalypse",
        "event": "BSides Budapest",
        "location": "Budapest, Hungary",
        "date": "2026-04",
        "type": "roundtable"
      },
      {
        "title": "From Manual Hunt to Mass Detection: Weaponising Nuclei Against Phishing",
        "event": "BSides Budapest",
        "location": "Budapest, Hungary",
        "date": "2026-04",
        "type": "talk"
      },
      {
        "title": "Phishing talk",
        "event": "BSides Luxembourg",
        "location": "Esch-sur-Alzette, Luxembourg",
        "date": "2026-05",
        "type": "talk"
      },
      {
        "title": "DNS OSINT Techniques",
        "event": "BSides Luxembourg",
        "location": "Esch-sur-Alzette, Luxembourg",
        "date": "2026-05",
        "type": "talk"
      },
      {
        "title": "Ghost in the Hiring Machine",
        "event": "ElbSides",
        "location": "Hamburg, Germany",
        "date": "2026-06",
        "type": "talk"
      },
      {
        "title": "DEF CON 34 Recon Village talk",
        "event": "DEF CON 34 Recon Village",
        "location": "Las Vegas, Nevada, USA",
        "date": "2026-08",
        "type": "talk"
      },
      {
        "title": "Zero Day Hire — DEF CON 34 Social Engineering Village workshop (1)",
        "event": "DEF CON 34 Social Engineering Village",
        "location": "Las Vegas, Nevada, USA",
        "date": "2026-08",
        "type": "workshop"
      },
      {
        "title": "Zero Day Hire — DEF CON 34 Social Engineering Village workshop (2)",
        "event": "DEF CON 34 Social Engineering Village",
        "location": "Las Vegas, Nevada, USA",
        "date": "2026-08",
        "type": "workshop"
      },
      {
        "title": "Ghost in the Hiring Machine",
        "event": "BSides Las Vegas",
        "location": "Las Vegas, Nevada, USA",
        "date": "2026-08",
        "type": "talk"
      },
      {
        "title": "Ghost in the Hiring Machine",
        "event": "Hack Glasgow",
        "location": "Glasgow, Scotland, UK",
        "date": "2026-08-15",
        "type": "talk"
      },
      {
        "title": "Ghost in the Hiring Machine",
        "event": "SecTor",
        "location": "Toronto, Canada",
        "date": "2026-10-07",
        "type": "talk"
      },
      {
        "title": "ProjectDiscovery Interview",
        "event": "ProjectDiscovery",
        "location": "Remote",
        "date": "2026",
        "type": "interview"
      },
      {
        "title": "Current State of AI Roundtable",
        "event": "Current State of AI",
        "location": "Budapest, Hungary",
        "date": "2026-04",
        "type": "roundtable"
      }
    ]
  },
  "skills": {
    "domains": [
      "vulnerability research",
      "threat intelligence",
      "detection engineering",
      "osint",
      "attack surface management",
      "supply chain security",
      "internet-wide scanning",
      "phishing detection",
      "AI security",
      "public speaking",
      "mentoring"
    ],
    "tooling": [
      "nuclei",
      "amass",
      "nettacker",
      "shodan",
      "dns osint",
      "certificate transparency",
      "go",
      "cve / cvss / epss analysis",
      "honeypots",
      "signature development"
    ]
  }
}