Ioneyrezende - DEV Community

Ioneyrezende

Oct 29

Nagios Core CGI Exposure: Authentication Is Not Enough Without Command Authorization

#zoomeye #nagios #monitoring

3 min read

Ioneyrezende

Oct 29

Adminer fingerprints are leads to database management, not proof of access

#cybersecurity #autonomous #defensiveengineering

3 min read

Ioneyrezende

Oct 29

From Virtual Key to Internal Target: Responding to LiteLLM SSRF

#security #incidentresponse #litellm #ssrf

2 min read

Ioneyrezende

Oct 29

Authenticated time is an operational security control

#ntp #networktimesecurity #timeintegrity

2 min read

Ioneyrezende

Oct 29

Alertmanager API exposure can change the alerting path

#prometheus #alertmanager #zoomeye

2 min read

Ioneyrezende

Oct 29

HTTP request smuggling starts when two parsers disagree

#http #requestsmuggling #reverseproxy

4 min read

Ioneyrezende

Oct 29

Directus discovery must include collection and field permissions

#zoomeye #directus #accesscontrol

3 min read

Ioneyrezende

Oct 28

Vector's product fingerprint returns one match while its title is too broad to interpret

#zoomeye #vector #observability

2 min read

Ioneyrezende

Oct 28

Node-RED exposure inventory: separate editor exposure from flow endpoints

#security #zoomeye

2 min read

Ioneyrezende

Oct 28

Designing neutral authentication errors after CVE-2026-11960

#vulnerability #facturascript #authentication #design

4 min read

Ioneyrezende

Oct 28

475 Electrum Titles Are a Web Footprint, Not a Wallet Census

#zoomeye #electrum #walletsecurity #assetinventory

3 min read

Ioneyrezende

Oct 28

Detecting exploitation of CVE-2026-105740 in Langflow logs

#vulnerability #langflow #cve2026105740 #mcp

2 min read

Ioneyrezende

Oct 28

Patch Governance When the Vulnerable Code Is Not the Service

#vulnerability #rabbitmq #amqp #cve202644236

1

3 min read

Ioneyrezende

Oct 28

Fifty-One Thousand Media Request Queues, and Not One Application Signature

#selfhosted #media #measurement #zoomeye

3 min read

Ioneyrezende

Oct 28

Tailworm: eleven unfixed flaws in a mesh VPN, and the SSH path that carries root

#security #vpn #privilegeescalation

4 min read

Ioneyrezende

Oct 27

3CX at 976,119 titles and 31,398 fingerprints: one product name, two very different populations

#security #zoomeye #attacksurface

3 min read

Ioneyrezende

Oct 27

Dovecot answers 30.7 million times as an application and 32 times as a title

#zoomeye #mail #imap #exposuremeasurement

4 min read

Ioneyrezende

Oct 27

Detecting CVE-2026-6653 attempts when the crash is the signal

#libxml2 #cve20266653 #vulnerability #zoomeye

2 min read

Ioneyrezende

Oct 27

After Plex2Shell: A Detection and Recovery Checklist for Media Servers You Cannot Rebuild Blindly

#vulnerability #plex #rce #exposure

4 min read

Ioneyrezende

Oct 27

Patching NGINX Without a Maintenance Window: Five Workarounds and Their Real Cost

#devops #infrastructure #security

3 min read

Ioneyrezende

Oct 27

Why a virtualisation panel is worth the attacker's effort

#security #zoomeye #vmmanager #hosting

3 min read

Ioneyrezende

Oct 27

Oracle SOA Suite has 622 body matches and no page title that names it

#zoomeye #exposuremeasurement #middleware

3 min read

Ioneyrezende

Oct 26

An eight-byte buffer and a permanent error: engineering lessons from CVE-2026-111497

#security #vulnerability #node #brotli

3 min read

Ioneyrezende

Oct 26

Six weeks from notice to KEV: the disclosure timeline behind the Plex RCE chain

#vulnerability #plexmediaserver #cve202696654 #remotecodeexecution

1

4 min read

Ioneyrezende

Oct 26

Zammad's two flaws were chained in seconds by an automated agent, and the second one is about service accounts

#vulnerability #zammad #privilegeescalation #incident

5 min read

Ioneyrezende

Oct 26

Reachable Is Not the Same as Compromised: Scoping BeyondTrust Appliances After CVE-2026-102764

#zoomeye #incidentresponse #beyondtrust #exposuremanagement

3 min read

Ioneyrezende

Oct 26

Reading 507 SiteGuard Assets Correctly After CVE-2026-106931

#vulnerability #exposuremanagement #zoomeye #webapplicationfirewall

4 min read

Ioneyrezende

Oct 26

CVE-2026-33789 and CVE-2026-33796: How BGP Monitoring Protocol Became an Attack Surface on Junos

#cybersecurity #networking #security

4 min read

Ioneyrezende

Oct 26

A self-hosted CI runner is a credential store that also executes whatever the repository says

#cicd #supplychain #hardening

1

4 min read

Ioneyrezende

Oct 25

Six minor releases of exposure: what the NSD 4.10.0 to 4.15.2 range says about patch cadence

#dns #nsd #vulnerability

3 min read

Ioneyrezende

Oct 25

Trusting a forwarding header without proving who wrote it is an authorisation decision

#websecurity #reverseproxy #nginx #authorisation

2

4 min read

Ioneyrezende

Oct 25

Reading the severity split: NGINX calls the October 2026 fixes medium while F5 scores them 9.2

#nginx #cve202693479 #vulnerability #patchmanagement

4 min read

Ioneyrezende

Oct 25

CVE-2026-96951: The Mark-of-the-Web Bypass and the Limits of Trust-on-Download

#vulnerability #windows #defenceindepth

4 min read

Ioneyrezende

Oct 25

The Plex transcode path that accepts arbitrary hosts, and what that means for internal networks

#cybersecurity #infosec #security

2 min read

Ioneyrezende

Oct 25

Mixed PAN-OS estates and CVE-2026-0321: why Cloud NGFW being unaffected is not a holiday

#panos #cve20260321 #assetmanagement #governance

3 min read

Ioneyrezende

Oct 25

PHP2Shell: a patch-verification and hunting plan for the four days before disclosure

#php #php2shell #cve2026109618 #cve2026109619

4 min read

Ioneyrezende

Oct 25

19.4 million BIND fingerprints, and the two facts a scan cannot tell you about CVE-2026-94300

#zoomeye #bind9 #dns #cve202694300

4 min read

Ioneyrezende

Oct 24

Upgrading past CVE-2026-74041: change control for a critical Wazuh Manager fix

#vulnerability #wazuh #cve202674041 #securitymonitoring

2 min read

Ioneyrezende

Oct 24

419,779 Workflow Engines Hold the Keys to Everything Else

#zoomeye #n8n #automation #credentialexposure

3 min read

Ioneyrezende

Oct 24

Ivanti Connect Secure: an exploited privilege escalation and a quieter credential path

#security #vulnerabilitymanagement

4 min read

Ioneyrezende

Oct 24

The vulnerability scanner stores what it finds

#security #attacksurfacemanagement

3 min read

Ioneyrezende

Oct 24

Two SQL Injection Flaws in Zabbix, and Why the API Account Is the Real Perimeter

#zabbix #cve202442327 #cve202422120 #sqlinjection

4 min read

Ioneyrezende

Oct 24

The fast-jwt fix for algorithm confusion missed the prefix

#jwt #authentication #library #npm

5 min read

Ioneyrezende

Oct 24

SkyWalking answers 7,586 titles on 8080 and almost nothing on 12800

#zoomeye #apm #observability

3 min read

Ioneyrezende

Oct 23

The Plex patch cluster: why one CVE is not the whole story

#vulnerability #cve202696655 #plex #ssrf

3 min read

Ioneyrezende

Oct 23

PHP2Shell: what 884,000 unpatched hosts mean for the PHP runtime you forgot you were running

#security #cybersecurityarticle

4 min read

Ioneyrezende

Oct 23

A backup plugin with wrong file permissions turns shared hosting into root

#security

4 min read

Ioneyrezende

Oct 23

Coolify: 70,210 titles against 3 fingerprints, and the port that explains the gap

#security

3 min read

Ioneyrezende

Oct 23

Same week, same interpreter: CVE-2026-109618 and the two-defect PHP release

#php #remotecodeexecution #cve2026109618 #vulnerability

3 min read

Ioneyrezende

Oct 23

Eight Intermediates and a Key That Was Just a Number: What the eMudhra CA Compromise Means for Non-Browser Clients

#pki #certificateauthority #truststore #supplychain

3 min read

Ioneyrezende

Oct 23

Patched Is Not the Same as Safe: Reading Version and Exposure for BeyondTrust Appliances

#zoomeye #vulnerabilitymanagement #beyondtrust #verification

4 min read

Ioneyrezende

Oct 23

FortiSIEM and port 27918: what an open port does and does not tell you

#security #zoomeyearticle

3 min read

Ioneyrezende

Oct 22

Third VeloCloud Orchestrator Flaw Exploited in 2026: CVE-2026-114625 in a Pattern

#trendanalysis #sdwan #vulnerabilitymanagement #arista

2 min read

Ioneyrezende

Oct 22

Headscale: 85 title matches against 18 on 443 and 7 certificate hits

#zoomeye #meshnetwork #controlplane

3 min read

Ioneyrezende

Oct 22

A Stolen Configuration Is Not an Exploit, and That Is the Problem

#fortinet #credentialrotation #incidentresponse #zoomeye

1

3 min read

Ioneyrezende

Oct 22

CVE-2026-0313 Patch Work: Getting the Cortex OS Query Pack to 1.0.17

#vulnerability #cortexxsoar #cve20260313

4 min read

Ioneyrezende

Oct 22

MariaDB in a Multi-Tenant Environment: What AL-2026-144 Changes for Shared Instances

3 min read

Ioneyrezende

Oct 22

The Structural Problem Behind CVE-2026-0315: Endpoint Agents and Local Root

#endpointsecurity #macos #privilegeescalation #architecture

4 min read

Ioneyrezende

Oct 22

Cold Chain, Cold Comfort: What the Danfoss Case Says About Buying Exposed Equipment

#security #zoomeye #procurement #ot

5 min read

Ioneyrezende

Oct 22

Zammad CVE-2026-102489 and CVE-2026-102490: When the Support Desk Becomes the Entry Point

#vulnerability #collaboration #zammad

3 min read

Writing Debut

Want to connect with Ioneyrezende?