From caab2a98d12280f75770b7996ced1ba797567e5e Mon Sep 17 00:00:00 2001
From: Icex0 <99045665+Icex0@users.noreply.github.com>
Date: Sat, 18 Jul 2026 02:16:04 +0200
Subject: [PATCH] Update README.md

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index dade442..e397559 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,10 @@ can use that database read path to recover administrator password hashes. Turnin
 plugin-upload code execution is outside the unauthenticated primitive and depends on obtaining valid
 administrator credentials.
 
+Searchlight has not published the final jump from SQLi to pre-auth RCE. That may involve a
+database file-write trick such as MySQL `OUTFILE`, or it may be something else in core. This repo
+does not include that step.
+
 ## Requirements
 
 Python 3.8+ and the standard library. No third-party dependencies.