Marcio Almeida

About the author

Marcio Almeida

Co-Founder & Director of Technical Services, Tanto Security

Marcio Almeida is one of the Co-Founders and the Director of Technical Services at Tanto Security. He has worked in cyber security for over 15 years and has experience with Penetration Testing, Code Review, Exploit Development, Secure Development, DevSecOps and Red Team Operations.

Posts

Vulnerability

From Arbitrary File Read to Shell: Yet Another RCE in Telerik

Marcio Almeida

27 Oct 2026

A vulnerability in Telerik UI for ASP.NET AJAX led to an arbitrary file read via RadImageEditor's image cache. Leaking web.config turned it into RCE.

Vulnerability

From Padding Oracle to Shell: RCE in Telerik UI for ASP.NET AJAX

Marcio Almeida

7 Sep 2026

How a sacrificial block turned a decrypt-only padding oracle into a forgery, and the forgery into unauthenticated RCE.

Vulnerability

Sleepless Strings: Template Injection in Insomnia

Marcio Almeida and Justin Steven

19 Jun 2025

Template injection in Kong’s Insomnia API client leads to remote command execution that survived three attempted fixes.

Vulnerability

Dompdf RCE via Phar Deserialisation

Marcio Almeida

6 Oct 2022

A font URL protocol check didn’t stop when it failed, allowing a TrueType-Phar polyglot to reach code execution.