yutianle - DEV Community

yutianle

Oct 11

Three JFrog Artifactory Flaws in One KEV Cycle: Authentication Failures in the Build Supply Chain

#security #vulnerability #exploitedinthewild

3 min read

yutianle

Oct 11

MemTensor: When an AI Memory Plugin Becomes the Credential Collector

#supplychain #npm #pypi #aiagents

2 min read

yutianle

Oct 10

ZooKeeper Flaws Ripple Through Hadoop and Kafka Dependency Chains

#apachezookeeper #vulnerability #cve202659739 #distributedsystems

1 min read

yutianle

Oct 10

How many worker processes can a single WebDAV lock loop take down

#security #apache #httpd #webdav

2 min read

yutianle

Oct 10

Dependency Verification: What Pinning Buys and What It Does Not

#supplychain #dependencies #verification

2 min read

yutianle

Oct 10

Citrix NetScaler CVE-2026-19490: The Second Authentication Bypass in a Single Quarter

#citrix #netscaler #authenticationbypass #gateway

3 min read

yutianle

Oct 10

1,577,590 F5 BIG-IP Matches: Sizing the Management Plane After Two KEV Entries

#zoomeye #f5 #exposure #kev

1

3 min read

yutianle

Oct 10

Akaunting: 1,511 fingerprints and 480 titles for an accounting system online

#accounting #akaunting #finance

2 min read

yutianle

Oct 9

Elasticsearch on 351,041 observed hosts: search clusters and the data they were never meant to expose

#attacksurface #zoomeye #elasticsearch #dataexposure

2 min read

yutianle

Oct 9

The Malvertising Supply Chain Behind the Toll Fraud Campaign: 1,235 Ads, 74 Profile Names

#malvertising #metaads #googleplay #tollfraud

4 min read

yutianle

Oct 9

Dolibarr: 4,209 title matches against 829 fingerprint matches on the same ERP

#zoomeye #erp #measurement

3 min read

yutianle

Oct 9

Alluxio's S3 proxy skipped signature verification, and everyone was root

#vulnerability #storage #authentication

3 min read

yutianle

Oct 9

Contributed module risk in Drupal: the lesson behind CVE-2026-96360

#drupal #webform #cve202696360 #xss

2 min read

yutianle

Oct 9

Detection content as code: reviewing a change the way you review software

#security #detectionengineering #siem

2 min read

yutianle

Oct 8

Cacti, LibreNMS, Icinga and Observium: measuring the monitoring tier nobody replaces

#infrastructure #monitoring #sre

2 min read

yutianle

Oct 8

Patch or Shield? Choosing an Upgrade Path for CVE-2026-76471

#cisco #patching #riskmanagement

2 min read

yutianle

Oct 8

Proving log coverage instead of assuming it

#logging #detection #monitoring

2 min read

yutianle

Oct 8

SaltStack at 60,140 observed assets: remote execution as a standing capability

#security

3 min read

yutianle

Oct 8

CVE-2026-75937: why a management interface decides the risk

#security #vulnerability #cve202675937 #digi

2 min read

yutianle

Oct 8

Canary tokens are a detection control, and detection controls can be measured

#detection #canarytokens #honeytokens #deception

4 min read

yutianle

Oct 7

Two Critical Bugs, One Router: What the D-Link DIR-822A Disclosures Mean for Home Networks

#security #vulnerability #router #dlink

1

3 min read

yutianle

Oct 7

SPDX or CycloneDX: Choosing an SBOM Format You Can Actually Operate

#supplychain #sbom #compliance

4 min read

yutianle

Oct 7

DNS Tunneling and Egress Control: Closing the Channel That Almost Always Works

#networksecurity #detection #dns #mitreattack

4 min read

yutianle

Oct 7

Detection and response notes for CVE-2026-85714

#vulnerability #stirlingpdf #cve202685714

2 min read

yutianle

Oct 7

ShowDoc 3.9.2 and the username field that ends up as PHP

#security #vulnerability #php #sqlite

3 min read

yutianle

Oct 7

3,331,906 on Port 7001 and 1,037,743 on Port 7199: Java Middleware and Its Management Ports

#zoomeye #java #middleware #managementplane

2 min read

yutianle

Oct 6

Sizing the Kestra Attack Surface: What Internet Measurement Shows About Workflow Orchestration Exposure

#zoomeye #exposuremanagement #kestra #workfloworchestration

4 min read

yutianle

Oct 6

Fingerprint or Not: Choosing the Right ZoomEye Query for a GeoServer Investigation

#security #geoserver #cve202436401 #attacksurface

3 min read

yutianle

Oct 6

256,996 MinIO Fingerprints and 198,176 Prometheus Fingerprints

#cybersecurity #infrastructure #monitoring #security

2 min read

yutianle

Oct 6

CVE-2026-5430: the JWT validator that skipped signature checking when it met an algorithm it did not know

#authentication #apisecurity #vulnerability

2 min read

yutianle

Oct 6

111 and 2049: RPC and NFS Endpoints in an Internet-Facing Population

#cybersecurity #infosec #networking #security

3 min read

yutianle

Oct 6

CVE-2026-59797: Why an Apache httpd Privilege Bug Outranks a Crash

#security #apache #httpd #vulnerability

2 min read

yutianle

Oct 5

Why an Authenticated GitLab Account Is Enough for Server-Side Code Execution

#vulnerability #gitlab #remotecodeexecution #cicd

2 min read

yutianle

Oct 5

Woodpecker CI at 1,831 Titles and 2 Application Fingerprints: What a Narrow Signature Gap Means

#zoomeye #exposure #cicd #measurementmethod

3 min read

yutianle

Oct 5

Copy Fail (CVE-2026-31431): 732 bytes from a low-privilege shell to root on Linux

#linux #privilegeescalation #kernel

2 min read

yutianle

Oct 5

A photo library is an identity record that happens to contain pictures

#zoomeye #exposure #immich #attacksurface

3 min read

yutianle

Oct 5

Assessing Real-World Risk From CVE-2026-78249 Without Overstating It

#vulnerability #pathtraversal #mfp #printing

2 min read

yutianle

Oct 5

Certificate name verification: wildcards, SANs and the checks that fail open

#tls #pki #certificates

3 min read

yutianle

Oct 4

Lateral Movement Across Zimbra Clusters via CVE-2026-73570

#security #vulnerability #zimbra #cve202673570

2 min read

yutianle

Oct 4

When an Agent Reaches Root: The Zammad Attack and Machine-Speed Intrusion

#vulnerability #zammad #cve2026102490 #helpdesk

2 min read

yutianle

Oct 4

Confluence exposure: 1.8 million fingerprint matches depend on which fingerprint you use

#confluence #fingerprintcoverage #exposuremanagement

2 min read

yutianle

Oct 4

Zipkin at 40 Titles and 562 Fingerprints: When the Signature Finds More Than the Name

#zoomeye #exposure #observability #measurementmethod

4 min read

yutianle

Oct 4

6,918 Paperless matches: a document archive that was meant to replace the filing cabinet

#exposure #zoomeye

2 min read

yutianle

Oct 4

ShieldCrash: A Second Path Around the Microsoft Defender ShieldBreak Fix

#vulnerability #windows #defender #privilegeescalation

3 min read

yutianle

Oct 3

GitLab CVE-2026-85706: When a Path Traversal Lands in the Software Delivery Chain

#pathtraversal #devsecops #credentialexposure #vulnerabilitymanagement

4 min read

yutianle

Oct 3

Measuring Edge Gateway Exposure: Why the Right ZoomEye Query Matters More Than the Number

#exposuremanagement #internetmeasurement #edgesecurity #zoomeye

4 min read

yutianle

Oct 3

Internet-Exposed RDP Is Still the Ransomware On-Ramp the Gunra Advisory Warns About

#cybersecurity #infosec #security #vulnerabilities

3 min read

yutianle

Oct 3

Microsoft SharePoint exposure: 163,266 matching assets and a code injection flaw that needs only a user account

#zoomeye #sharepoint #exposuremanagement #codeinjection

3 min read

yutianle

Oct 3

Prioritizing a 974-CVE Patch Tuesday Without Freezing Your Deployment Pipeline

#security #patchmanagement

3 min read

yutianle

Oct 2

HAProxy: 49,691 Fingerprint Matches at the Front Door

#haproxy #loadbalancer #tlstermination #statisticsinterface

3 min read

yutianle

Oct 2

Path filters that do not filter: CVE-2026-57441 and CVE-2026-57442 in MCPVault

#cve202657441 #cve202657442 #mcp #pathtraversal

3 min read

yutianle

Oct 2

CVE-2026-89775: Reading Host Memory From an ARM64 KVM Guest

#kvm #arm64 #vmescape #cve202689775

4 min read

yutianle

Oct 2

Gitea: 116,010 fingerprints against 120,024 titles, and the self-hosted forge as an identity boundary

#exposure #sourcecontrol

3 min read

yutianle

Oct 2

12,488,458 answers on port 9080 beside 77,076 WebSphere matches: reading a Java middleware estate

#backend #infrastructure #java #software

3 min read

yutianle

Oct 2

GitLab CVE-2026-85706: Why an Arbitrary File Read on a DevSecOps Platform Is a Credential Incident

#gitlab #pathtraversal #credentialrotation #kev

3 min read

yutianle

Oct 1

Prioritising CVE-2026-85706 Work: What a Read on a GitLab Host Is Worth

#gitlab #riskprioritisation #secretsmanagement #cve202685706

3 min read

yutianle

Oct 1

Distributing the Risk: What Global Docker Exposure Numbers Do and Do Not Show

#docker #measurement #risk #zoomeye

1

3 min read

yutianle

Oct 1

Key rotation as a scheduled operation

#keymanagement #cryptography #operations

2 min read

yutianle

Oct 1

Concourse: 3,767 title matches on the pipeline system that executes your build code

#zoomeye #concourse #cicd #buildsystem

2 min read

yutianle

Oct 1

Availability risk on the VPN concentrator: the denial-of-service side of CVE-2026-88772

#security #vulnerability #citrix #netscaler

3 min read

Writing Debut

Want to connect with yutianle?