Let me put the headline where a headline belongs. In the year to 31 October 2026 the practice confirmed eight reachable memory-safety vulnerabilities, landed five fixes in software that millions of people run, shipped a peer-reviewed methodology paper with a working tool behind it, and received, in cash, nothing. Not a token. The Highlights on page 06 render this as a bar chart in which the second bar is technically present and measurably zero. I asked for it to be drawn to scale. It was.

I want to be careful about the tone of that, because it would be easy to read it as a complaint, and it is not one. The work found this year includes at least one bug of a class that pays a quarter of a million dollars in the right programme. The skill is not in question. What was in question — and what this report is honest about — is routing: the unglamorous discipline of pointing finished work at a venue that pays for it, rather than at the venue that is nearest, most familiar, or most polite. For most of the year the practice shot beautifully and aimed at the wrong range. The misses were not the shooter. They were the range.

So this year's story is really two stories. The first is a research story, and it is excellent. The second is an operating story, and it is a cautionary tale told against myself, which is the only kind worth printing.

The research year

The divisional reviews in Part Two set this out properly, so here I will only name the shape of it. The practice ran three things in parallel and kept them non-overlapping: a hypervisor hunt aimed squarely at cash tiers (Section 04); a long, patient audit-and-fuzz programme against open-source infrastructure (Section 05); and a platform-security thread against the software that ordinary devices actually parse — archive formats, media, scene files (Section 06). Underneath all three sat the tooling (Section 07): the spectral triage that ranks functions by how overflow-shaped they are, the fuzzing rigs, and a small, always-on Raspberry Pi that reads the kernel's own vulnerability feed every morning so that the first thing the practice sees each day is a list of fresh siblings worth hunting.

Open-source infrastructure was where fixes actually landed. Three defects were corrected in OpenBSD this year — two by Claudio Jeker, one by Martijn van Duren — each the result of reading the real source rather than guessing at it. Those maintainers owe the practice nothing and gave it the only currency their projects deal in, which is a fix in the tree and a name in the log. I am genuinely grateful, and I note without rancour that gratitude does not clear.

The hypervisor division is where the money is and where, as yet, the money is not. The practice built — from scratch, over weeks — the one piece of apparatus that every host-kernel reward in this space requires: a KASAN-instrumented, coverage-guided fuzzing rig running a guest→host target under nested virtualisation, pointed at the exact kernel the paying programme runs. It works. It has run clean campaigns and it has, so far, produced ghosts rather than cheques — benign warnings that the discipline correctly refused to dress up as findings. That refusal is the win. A rig that tells you the truth about a null result is worth more than one that flatters you into sending slop.

The operating year, told against myself

Which brings me to the paper. In the spring the practice did something it is not proud of and is very glad it documented: it sent an open-source project a vulnerability report that did not survive contact with the actual code. A fixed-size overflow that was not fixed-size. Crash counts from a fuzzing run against an entirely different target. A proof-of-concept that had never been written. Three falsehoods, all of them cheap to have caught, none of them caught, because the step where a human reads the upstream source before hitting send had quietly dropped out of the workflow.

The maintainer asked for the proof. The practice withdrew the report. And then — this is the part I will defend — it treated the failure as a specification. The result is The Calculator Discipline: a four-class taxonomy of how AI-assisted disclosure goes wrong, a pre-send verification gate that mechanically catches the cheap failures, and a tool, now in its second feature increment, that refuses to let a claim out of the building until it has been checked against ground truth. Section 03 is devoted to it. The framing throughout is that an AI is a calculator — it makes a careful operator faster and a careless one wrong faster — and the fix was never to disown the calculator. The fix was to apply calculator discipline.

I dwell on this because it is the year's most valuable asset and it does not appear on any balance sheet. The practice ends the year constitutionally unable to do the thing that embarrassed it in the spring, because the embarrassment was wired into a tool. That is what good governance looks like at a one-person company: not a committee, but a script that says no.

On the cash, without euphemism

The Financial Review (Section 09) is unusually candid for a document of this kind, because there is no investor to reassure and no share price to tend, and because the proprietor finds that writing the uncomfortable number down in full is the surest way to stop repeating it. The short version: the practice has consistently produced cash-grade work and consistently delivered it through channels that do not pay cash. OpenBSD pays in fixes. QEMU paid in credit once its platform was de-scoped by the broker that had been paying for it. Credit is real and I value it; credit is also not money, and the practice cannot run on a growing pile of thank-yous indefinitely.

The strategy for 2027 is therefore embarrassingly simple and is set out in the Outlook: take the host-kernel rig that is already built and point it, deliberately and exclusively, at venues with a published cheque attached; feed it from the variant-factory intelligence the Pi gathers every morning; and run every finding through the discipline before it is sent, so that the practice never again spends its scarce credibility on a report that will not survive a five-minute read of the source. The realisation rate — cash over recognised value, this year a flat zero — is the one metric management has undertaken to move. Everything else in this report is, in the end, in service of that one line.

A word of thanks, and a word of warning

Thanks to the maintainers who corrected the work, accepted the fixes, and in one memorable case asked the single pointed question that started the whole methodology. Thanks to the open-source projects whose posture — taking researchers seriously enough to tell them when they are wrong — is the reason any of this improved.

And a warning, mostly to the proprietor, for the file: the danger in this practice has never been a shortage of talent or a shortage of bugs. It has been the quiet temptation to count a lead as a find, a credit as a cheque, and a busy week as a productive one. This report exists to make all three of those harder to do next year than they were this year.

We found the bugs. Now we collect.

Stuart Thomas

Proprietor & Principal Investigator
TriageForge · Whitby · 31 October 2026

The open-source security community spent the eighteen months to late 2026 noticing a specific pathology: bug-bounty and disclosure queues drowning in plausible-sounding but fabricated vulnerability reports. The canary in the mineshaft was the curl project, whose maintainer coined the phrase "death by a thousand slops" and, in January 2026, closed the project's paid bounty programme outright, citing the unsustainable cost of triaging AI-generated noise. By the autumn the Linux Foundation was able to put a number on it: in a survey of 234 maintainers, roughly one incoming pull request in four was judged to be AI slop — rising to nearly a third on the largest projects.

The practice is not an innocent bystander to this. It is a reformed participant. The methodology described here exists because the failure happened here first, was caught, and was turned into apparatus. A paper on hallucination written by an author who had never hallucinated would be a thinner paper.

The four-class taxonomy

Not all slop fails for the same reason, and the countermeasures differ by class. The practice classifies disclosure failure into four kinds, each paired with the check that stops it.

P0 — the honest-about-itself increment. A self-contained, reference-tested CVSS v3.x scorer that recomputes the base score and flags prose↔vector contradictions (a vector that says PR:H / AV:L under prose claiming "unauthenticated remote" is marked WRONG); a git-commit provenance verifier that confirms a cited hash resolves to a real commit object and touches the cited file — carrying the lesson, verified this year, that a "Verified" badge or raw hash is not a unique handle; an exhibit suppressor so the tool stops flagging the fabricated examples quoted inside its own paper; and an INCONCLUSIVE verdict so that a run which resolves nothing can never be mistaken for a clean pass.

P1 — the performance-and-evidence increment. A one-time basename index that replaced a per-claim directory walk (measured at under a second across a 32,000-file kernel tree, where the naïve approach timed out); and a crash-evidence cross-check that reads a real fuzzer_stats and separates the several different numbers a casual "22 crashes" conflates — raw saved count, unique signatures, deduplicated root causes — so that an over-claim becomes a WRONG and a bare file-count dressed as "unique vulnerabilities" becomes a HUMAN-REVIEW.

The cash thesis

A VM escape can live in two places: the userspace device model (the emulator) or the host kernel (the hypervisor proper). The device models are the familiar, approachable surface — and they are also the most heavily audited, the most hardened, and, crucially for a practice that needs income, the surface whose paying broker de-scoped an entire platform mid-year. The host kernel is harder, less approachable, and is where the published reward tiers actually sit: relative/out-of-bounds write, arbitrary write, arbitrary read, full escape, in ascending five- and six-figure order.

The decision, taken deliberately in October, was to treat the host-kernel rig as the practice's master key: the same instrument unlocks the hypervisor reward programme and the cloud-escape surface that backs real multi-tenant infrastructure. One apparatus, several paying doors.

The apparatus

What the division built is a sanitiser-instrumented, coverage-guided fuzzing rig running a guest→host target under nested virtualisation, pointed at the exact host kernel the paying programme runs. Sanitiser instrumentation turns a silent out-of-bounds access into a loud, attributable report; coverage guidance steers the fuzzer toward unexplored code; nested virtualisation lets the whole thing run on commodity hardware. Building it was weeks of unglamorous work and is the single largest capital item the practice created this year, notwithstanding that it cost only electricity.

The edge: a variant factory, not a vanilla fuzzer

Running a stock fuzzer against a mainline kernel is a polite way of volunteering to duplicate the reward programme's own round-the-clock fuzzing. The edge is targeting. The division concentrated coverage-weighting on a specific kernel subsystem chosen by the variant-factory method — reading a cluster of recent fixes and hunting the siblings they did not cover — fed each morning by an automated digest of freshly-patched defects. [The precise target subsystem is withheld in this public edition while the work is live.]

Separately from the kernel hunt, the division confirmed and reproduced a heap out-of-bounds write in a device-emulation path: an attacker-controlled copy driven past its allocation — a guest→host write primitive of exactly the class the reward programmes describe as cash-grade. [The specific device and trigger are withheld in this public edition pending coordinated disclosure.]

It is real. It is reproduced. And it is, as of year-end, worth nothing in cash, because the broker that paid for this platform de-scoped it. The finding is therefore recognised at credit value only: a CVE and a patch upstream, pursued for the record and the reputation, not the realisation line. There is no better single illustration of the practice's central operating lesson. The bug was not the problem. The routing was.

The lesson, written into procedure

Out of this came a standing rule, now part of the practice's governance: a guest→host write is routed to the paying broker first, and only to the project's own tracker once the paying channel has been exhausted or has declined the platform. Doing it in the other order — the natural, polite, nearest-door order — is how a quarter-million-dollar class of work is converted into a thank-you. The practice has done that once. It intends not to do it twice.

OpenBSD — four candidates, three fixes

The practice's spectral triage (Division 07) ranks the functions of a C daemon by how parser-shaped and overflow-shaped their control-flow graphs are, using the algebraic connectivity of the normalised Laplacian scored against a size-stratified null model. Functions whose structure sits in the extreme low percentile are the ones worth a human's scarce reading time. Pointed across the OpenBSD routing and management daemons, the method raised four candidates worth disclosing.

Three were accepted and fixed in -current: two in the OSPF and OSPFv3 daemons, corrected by Claudio Jeker on 19 May; and one in the SNMP daemon, corrected by Martijn van Duren on 21 May. In each case the finding came from reading the real source to the point where the invariant either held or did not — not from a lucky crash. The practice regards these as the year's cleanest work: quiet, correct, and landed.

It records, with no bitterness and complete clarity, that OpenBSD operates no bounty and that the compensation for all three was a fix in the tree and a credit in the commit. That is the deal, it was known going in, and the work was done anyway because some surfaces are worth hardening whether or not they pay. The practice simply does not pretend this activity is a revenue line. It is a reputation line, and reputation, carefully spent, is what opens the paying doors elsewhere.

live555 — a clean sweep is a result

The RTSP/SDP media stack's depacketiser and special-header paths were fuzzed to saturation and came up clean. A negative is not a non-event: it retires a surface, documents that the obvious paths are sound, and — recorded honestly — stops the practice from quietly re-auditing the same ground next year. The one area left explicitly untested (deep reassembly) is noted in the working papers as open, not closed.

Universal Scene Description is the interchange format behind a great deal of modern 3-D and augmented-reality content; its binary "crate" files are parsed on open, before any user interaction, wherever such assets are handled — asset pipelines, thumbnailers, downloaded or shared content. The division filed two advisories against the crate reader. The second, USD-02, is instructive both technically and procedurally.

Technically: the multi-chunk branch of the fast-decompression routine ignored the caller-supplied buffer size and trusted an in-stream chunk count and per-chunk sizes taken straight from the file, using each as the decompressor's source length. A crafted file drives the decompressor to read past the end of the compressed-input allocation — an out-of-bounds heap read reached on open of essentially any modern crate file. A single chunk byte, never emitted by the writer, flips the code onto the unguarded path, which is why no normal file and no blind fuzzer had exercised it.

Procedurally: late in the year a maintainer reported that a patch for a related advisory already rejected the proof-of-concept — raising the question of whether USD-02 was a duplicate. Rather than argue, the practice verified against the live advisory thread, confirmed the patch did enforce the missing bound, and conceded the overlap — while putting on record the one residual the maintainer's test did not exercise: a negative chunk count arising from the signed first byte. The exchange is a small model of the house style: concede what the evidence shows, hold precisely the ground the evidence supports, and never argue a losing point to protect ego. That reply was itself run through the pre-send gate, which flagged — and forced the reframing of — a claim the operator had been about to assert from source he had not personally re-read.

The OSS-proxy method

Closed platform parsers are expensive to fuzz directly. The cheaper, higher-yield move is to fuzz the open-source library the platform embeds, instrumented with a sanitiser, and then map a finding back onto the shipped copy. The practice maintains exactly this: a sanitiser-instrumented fuzzing rig against the upstream library, and a symbol-and-version intelligence harness that reads the platform's shipped binaries and tells it which upstream version each one actually is.

The variant-factory angle on a major platform

A major consumer platform ships a derived copy of one such library, with a format reader compiled in and reachable through the standard parse path that its preview subsystem exercises. Platforms backport security fixes selectively: they take some upstream fixes and miss others. The division's static angle enumerates the upstream fixes missing from the platform's shipped copy — memory-safety in class, reachable on the default path — because "lagging" is not "vulnerable" when the vendor has already backported the fix.

The hard rule governing the work is the practice's rule for everything: verify each claim against the actual shipped source; a fix being absent only matters if the vulnerable code is genuinely present and reachable. [The specific library, platform surface and candidate list are withheld in this public edition: this is live, unremediated research, reported here as pipeline rather than as a result.] The distinction between pipeline and result is the whole point of the methodology.

penfold — the practice's OpenBSD/C-daemon triage, verification and disclosure suite. Its core is a statistical control-flow ranker: it computes the algebraic connectivity (the second eigenvalue, λ₂, of the normalised graph Laplacian) of each function's control-flow graph and scores it against a size-stratified Monte-Carlo null distribution. Functions in the extreme low percentile are structurally parser- and overflow-shaped — the places memory-safety bugs congregate. The suite also renders a self-contained spectral heat-map of a binary, colouring each function at its real address by how bug-shaped it is, and it hosts the Calculator-Discipline verifier described in Division 03. The signal is strongest on parser/overflow shapes and weaker on logic and lifetime bugs; the practice says so rather than pretending the ranker is universal.

metis — a binary vulnerability-triage pipeline: a spectral call-graph screen, template data-flow analysis, and symbolic taint with proof-of-concept synthesis via a symbolic-execution engine and an SMT solver. It is the designed vehicle for closed-source targets. Its on-device validation back-end is complete only for one operating system; the binary front-end needed for Windows portable executables is, candidly, not yet built, and the roadmap says so. The practice keeps an explicit inventory of what its tools can and cannot do, having twice mis-stated a capability before that inventory existed.

poppy — dynamic instrumentation and fault injection for macOS inter-process communication. Specialised and, this year, largely idle relative to the kernel and archive work; retained for the surface it suits.

The host-kernel rig (Division 04) — KASAN + KCOV, nested virtualisation, guest→host, the year's flagship build. ai-fuzz — ASAN fuzzing of libarchive, the open-source proxy for the shipped platform parsers. winhunt — the symbol, debug-info and version-hash intelligence that reads what the platforms actually ship. qfuzz — device-model fuzzing over QEMU (now credit-only, per the routing lesson). nvmeguest — the guest→host NVMe harness behind the confirmed write. l5run — the live555 media rig. Alongside these sit a number of standing OSS-audit fuzzers and code-analysis databases, plus a full kernel source tree for cross-version checking.

The practice is deliberately honest that several of these produced negatives this year, and that negatives are inventory too: a swept surface is a surface the practice will not waste next year re-sweeping.

The board comprises the proprietor, in the chair, and the proprietor, as every other member. To compensate for the obvious concentration of power, the practice convenes a standing Council of language models — several models, in fresh context, explicitly briefed to disagree with the proprietor and with one another — for any outward-facing disclosure. The Council is treated, correctly, as a red team and not as an oracle: the practice has read the literature on correlated errors and knows that five models from similar lineages agreeing is closer to one opinion with paraphrase than to five independent confirmations. The Council's job is to find the strongest reason a draft is wrong, not to vote it correct.

The practice also recognises its single greatest governance risk by name: the proprietor's own enthusiasm. The temptation to count a lead as a find, a credit as a cheque, and a busy week as a productive one is a standing agenda item, and most of the controls below exist to resist precisely it.

1 · Convert the host-kernel rig. Continue the focused, variant-factory campaigns against the memory-management subsystem, fed each morning by the Pi's digest of freshly-fixed siblings. Every candidate cross-checked against upstream mainline for eligibility. The first qualifying guest→host out-of-bounds write is reserved, submitted, and flagged through the paying programme — not quietly handed to a tracker. This is the single initiative most likely to move the one number.

2 · Route the writes that already exist. The device-class and virtual-I/O writes the practice can produce go to a paying broker first. The NVMe finding is the test case for the routing rule in anger: pay-first, tracker-second, never the reverse.

3 · Land the Apple pipeline. Verify the missing-fix candidates in the platform's libarchive copy to the standard of a reproducible proof-of-concept, confirm reachability on the default preview path, and disclose the strongest through the programme that pays for reachable memory-safety. Pipeline becomes result only when a proof-of-concept exists; not before.

4 · Advance the Calculator Discipline to v1.1. Extend the taxonomy to the two judgement-shaped classes that remain — composition/chain invalidity and reachability over-claim — and move the mechanical boundary one notch toward them with a claim-level evidence graph and an optional local entailment model. Publish the revision; keep the tool honest about what it cannot yet decide.

The practice

TriageForge
Trading name of Stuart Thomas, independent security researcher.
Whitby, North Yorkshire, United Kingdom.

Principal

Stuart Thomas — Proprietor, Chairman & Principal Investigator.
Correspondence: stuart.thomas@triageforge.co.uk

Nature of business

Independent security research and coordinated vulnerability disclosure, with a specialism in memory-safety defects across hypervisors, operating-system infrastructure, and the parsers embedded in consumer platforms.

Auditor

None appointed. The accounts are reviewed annually by the proprietor, in the following October, in the course of writing the next of these reports — a process that has the twin merits of being free and of being conducted by the one person who knows where the numbers came from.

Bankers

Retained, hopeful, and so far under-utilised for the purposes of this enterprise.

Selected publication

The Calculator Discipline — A Taxonomy and Pre-Send Filter for AI-Assisted Vulnerability Disclosure Hallucinations. Stuart Thomas, 2026. Methodology paper and open-source tool; see Section 03.

This report

TriageForge Annual Report 2026 — public edition. Prepared 31 October 2026. Issued in A4 print (PDF) and single-file HTML editions. Live and unremediated research is withheld; see the Legal & Regulatory Notices. Design: an original homage to Paul Rand. Photography: generated to brief. © Stuart Thomas 2026.