The breach library
Famous breaches, taken apart.
Plain-English breakdowns of the breaches everyone remembers. What broke, what it cost, and how to be sure the same class of bug is not sitting in your app right now.
2014CVE-2014-0160
Heartbleed
OpenSSL over-read leaked memory, keys, and sessions.
Read the breakdown
2021CVE-2021-44228
Log4Shell
A logged string triggered Log4j RCE across the internet.
Read the breakdown
2017CVE-2017-5638
Equifax
Unpatched Apache Struts RCE exposed ~147M records.
Read the breakdown
2019SSRF
Capital One
SSRF reached cloud metadata, exposing 100M+ records.
Read the breakdown
2023CVE-2023-34362
MOVEit Transfer
A SQL-injection zero-day drove mass data exfiltration.
Read the breakdown
2022Exposed API
Optus
An unauthenticated API returned millions of records.
Read the breakdown
2020Supply chain
SolarWinds
A backdoored update compromised thousands of networks.
Read the breakdown
2014CVE-2014-6271
Shellshock
Bash env-var parsing allowed remote command execution.
Read the breakdown
2022CVE-2022-22965
Spring4Shell
Data binding in Spring enabled remote code execution.
Read the breakdown
2018CVE-2018-7600
Drupalgeddon2
Unauthenticated RCE in Drupal core form handling.
Read the breakdown
Find your unnoticed bug before someone else does.
buggy.run signs in, captures your real traffic, and hunts the quiet flaws that scanners miss. You get every finding in plain English with the fix.