https://roeihadashi.com/ Red team, AI security and vulnerability research by Roei Hadashi, head of red team & ai security at HackersEye. en Thu, 13 Aug 2026 00:00:00 GMT https://hackerseye.com/blog/priority-portal-generator-nine-cves 2026-08-13:Priority Portal Generator: Nine CVEs in Israel's ERP Supply Chain Thu, 13 Aug 2026 00:00:00 GMT Roei Hadashi hackerseye.com Nine CVEs in the Portal Generator addon to Priority ERP, which served internal server addresses, an application secret, a licence key and working API credentials to every visitor before login. https://hackerseye.com/blog/asyncrat-webdav-and-bad-opsec-walk-into-an-israeli-bar/ 2025-06-19:AsyncRAT, WebDAV, and Bad OpSec Walk Into an Israeli Bar Thu, 19 Jun 2025 00:00:00 GMT Roei Hadashi hackerseye.com Tracing an AsyncRAT campaign delivered over WebDAV against Israeli targets, and what the operator’s operational-security mistakes gave away about the infrastructure behind it. https://profero.io/blog/secrets-leakage-rising-threat-development-practices-to-safeguard-your-secrets 2024-07-23:Secrets Leakage: A Rising Threat in Development Practices Tue, 23 Jul 2024 00:00:00 GMT Roei Hadashi profero.io How credentials escape into source control, build logs and client-side bundles, and the controls that actually stop it rather than just detecting it after the fact. https://profero.io/blog/sysaid-on-prem-vulnerability-disclosure 2023-11-07:SysAid On-Prem Zero-Day — CVE-2023-47246, exploited by Lace Tempest Tue, 07 Nov 2023 00:00:00 GMT Roei Hadashi profero.io Disclosure of a zero-day path traversal in SysAid On-Prem, found during incident response while the threat actor Lace Tempest was actively exploiting it. https://open.spotify.com/episode/30V8TDInUwZQ5wHNHxOOtq 2022-06-12:What Are Dependency Confusion Attacks? Sun, 12 Jun 2022 00:00:00 GMT Roei Hadashi 60 Sec on AppSec A short explainer on dependency confusion: why a package manager will happily prefer an attacker’s public package over your private one, and how to pin against it.