01 / 2024Independent research
Breaking the first-run boundary
Two independently discovered flaws in GoAnywhere MFT turned an initialization route into unauthenticated administrative access.
CVE-2024-0204 · CVE-2024-25156
Open to research, speaking, consulting, and roles
Vũ Chí ThànhVulnerability research,
made inspectable.
Vulnerability researcher building exploits and AI-assisted security tooling.
PortraitReplace / 01
Next chapterIncoming MSc Computing Science studentCyber Security specialisation · Radboud University · 2026–2028
Focus / 01Pre-auth attack surfaces
Practice / 02Web · Mobile · IoT
Output / 03Advisories · Exploits · Tools
01
Selected evidence
Research is strongest when the path from claim to primary source is short.
02 / 2026Co-research
SAML identity mismatch in authentik
An XML-comment interpretation conflict could bind an attacker's signed external identity to an existing authentik account.
CVE-2026-57580
03 / 2025Independent research
Chaining SSRF into session compromise
An unauthenticated SSRF and improper log neutralization in a-blog cms could be combined to hijack an administrative session.
CVE-2025-36560 · CVE-2025-41429
04 / 2026Co-research · with Ductinn
Unauthenticated RCE in 9Router
Missing authentication exposed privileged functionality; operating-system command injection turned that access into remote code execution.
02
Tools for the work
Small, composable systems that make analysis less repetitive and evidence easier to test.
01
IdeSense
Active · 2026An MCP server that gives coding agents access to JetBrains indexing, navigation, diagnostics, and refactoring instead of making them reason from raw files alone.
02
decaf
Active · 2026A sources-first Java decompiler CLI with five engines, automatic fallback, and support for nested archives.
03
A record of practice
From a part-time research internship to coordinated disclosure, mentoring, and international competition.
01
Jan 2026 — Jul 2026
Cyber Security Specialist
VinSOC
Security Technology Research Department02
Oct 2023 — Jan 2026
Cyber Security Researcher
Viettel Cyber Security
Offensive Security Service Center03
Apr 2024 — Sep 2025
Cyber Security Mentor
Korea Internet & Security Agency
Part-timeSelected competition record
Placements that complement the research record without replacing it.
2nd place, Cybersecurity Arena
Security Bootcamp
1st place, ROOTCON 18 CTF
ROOTCON Hacking Conference
Excellent Prize, HackTheon Sejong
Sejong Special Self-Governing City
1st place, ASEAN Cyber Shield
KISA
2nd place, Cyber SEA Game
AJCCBC
04
Beyond the report
A lab that never quite stays finished.
Outside formal research, I run a homelab for self-hosted services, monitoring, automation, network segmentation, and small local AI experiments. It is where infrastructure becomes tangible—and where I can break things on purpose.
01Wazuh · Uptime Kuma02n8n · Home Assistant03WireGuard · VLANs04Traefik · Cloudflare05Docker · Virtualization06Local AI · MCP
The useful kind of conversation
Have a difficult target,
an open research question,
or a stage to fill?
I am open to serious work where careful technical thinking matters.
hello [at] thanh [dot] vc