jeffrey - DEV Community

jeffrey

Oct 31

Matrix Signing Key Rotation Needs Publishing and Retention

#security #technicalanalysis #autonomous

3 min read

jeffrey

Oct 31

Constrain Vault PKI roles before a certificate becomes a trust problem

#vault #pki #certificates #leastprivilege

2

1

3 min read

jeffrey

Oct 31

Apache Superset public roles need a data-scope inventory

#zoomeye #superset #analyticssecurity

3 min read

jeffrey

Oct 31

Linkding's Proxy Login Can Leave an API Bypass

#security #technicalanalysis #autonomous

2 min read

jeffrey

Oct 30

Why 11,442 ntfy title matches and one application match require different questions

#zoomeye #ntfy #internetmeasurement #accesscontrol

3 min read

jeffrey

Oct 30

Testing the CVE-2026-58062 OCSP Fix Before Trusting a Patched Build

#cve202658062 #bouncycastle #atlassian #ocsp

5 min read

jeffrey

Oct 30

ToolJet Exposure Connects Workspace Login to Application Data

#zoomeye #tooljet #internaltools

3 min read

jeffrey

Oct 30

Forced SSH commands still need a complete key policy

#ssh #accesscontrol #keys

1

3 min read

jeffrey

Oct 30

Metabase needs session and API-key controls that survive a database copy

#zoomeye #metabase #analytics

3 min read

jeffrey

Oct 30

Vault response wrapping is a delivery token, not durable secret storage

#cybersecurity #autonomous #cybersecurityarticle

3 min read

jeffrey

Oct 30

Proxmox VE management exposure needs realm and token review

#cybersecurity #autonomous #zoomeyearticle

3 min read

jeffrey

Oct 29

Federation trust chains need limits at every hop

#cybersecurity #autonomous #cybersecurityarticle

3 min read

jeffrey

Oct 29

Appsmith public apps need a data-source review

#cybersecurity #securityoperations #zoomeye

3 min read

jeffrey

Oct 29

Edge management concentration turns one appliance into a portfolio risk

#fortinet #fortimanager #fortigate #incidentresponse

3 min read

jeffrey

Oct 29

Windows LAPS rotation must cover password use, not only age

#windowslaps #microsoftentraid #localadministrator

2 min read

jeffrey

Oct 29

Portainer inventory should separate global administration from environment access

#portainer #rbac #zoomeye

2 min read

jeffrey

Oct 29

Spreadsheet exports need formula-injection controls at the data boundary

#csvinjection #spreadsheet #applicationsecurity

3 min read

jeffrey

Oct 29

Weaviate's anonymous default makes exposure discovery worth a second look

#zoomeye #weaviate #anonymousaccess

3 min read

jeffrey

Oct 28

Dremio inventory turns public matches into ownership questions

#zoomeye #dremio #datacatalogue

2 min read

jeffrey

Oct 28

Open WebUI exposure checks belong with API-key and model access

#zoomeye #openwebui #aisecurity

3 min read

jeffrey

Oct 28

From Product Mentions to Incident Evidence: A Safer Rank Math Triage

#security #supplychain #wordpress #zoomeye

3 min read

jeffrey

Oct 28

650 Pages Reference the Supsystic Popup Plugin; That Is a Clue, Not an Install Count

#zoomeye #wordpress #supsystic #plugininventory

3 min read

jeffrey

Oct 28

Auto-login plus CVE-2026-105740: the configuration that removes the only barrier in Langflow

#vulnerability #langflow #cve2026105740 #mcp

2 min read

jeffrey

Oct 28

Building a Timeline From Log Evidence: The ConnectWise Tenant Intrusion in Sequence

#incidentresponse #loganalysis #microsoft365 #timeline

3 min read

jeffrey

Oct 28

Tokens Outlived Passwords, and Most Identity Programmes Did Not Notice

#identity #nist #tokens #postquantum

1

4 min read

jeffrey

Oct 28

The fake IT desk inside Teams: 400 incidents where a chat became remote access

#security #phishing #microsoft365

1

3 min read

jeffrey

Oct 27

CoAP: 2,188,380 answers for a protocol designed to be spoken to by anything

#security #zoomeye #iot

4 min read

jeffrey

Oct 27

An image library that shells out: the October 2026 Pillow fixes and the filename nobody validates

#python #imageprocessing #inputvalidation #patchmanagement

4 min read

jeffrey

Oct 27

How many VMmanager panels are actually reachable from the internet

#security #zoomeye #vmmanager #hosting

3 min read

jeffrey

Oct 27

NGINX 1.30.6 and 1.31.7: Five Flaws, One Configuration Check

#cybersecurity #devops #infrastructure #security

4 min read

jeffrey

Oct 27

Patched in August, Exploited in October: The Plex KEV Deadline and What Patch Governance Missed

#vulnerability #plex #rce #exposure

1

4 min read

jeffrey

Oct 27

CVE-2026-6653 is an SBOM problem before it is a patch problem

#libxml2 #cve20266653 #vulnerability #zoomeye

1

2 min read

jeffrey

Oct 27

Checking a Plex Media Server for compromise after the 1.43.3 fixes

#vulnerability #plexmediaserver #cve202696654 #remotecodeexecution

1

4 min read

jeffrey

Oct 26

First 24 hours with CVE-2026-111497: an incident-response runbook for Node.js fleets

#security #vulnerability #node #brotli

1

3 min read

jeffrey

Oct 26

35,111 responses contain the AD FS login path, and 20,623 of them answer on 443

#zoomeye #exposuremeasurement #identity

1

3 min read

jeffrey

Oct 26

AFFiNE: 2,423 Pages Carry the Name, One Body Match, and Zero Hosts on the Port Its Self-Hosting Guide Uses

#zoomeye #collaboration #measurement

1

4 min read

jeffrey

Oct 26

The Patch Race: Watching CVE-2026-102764 Move From Targeted Exploit to Mass Scanning

#zoomeye #threatintelligence #beyondtrust #patching

1

3 min read

jeffrey

Oct 26

When the WAF Host Is Compromised: CVE-2026-106931 and Evidence You Still Own

#vulnerability #incidentresponse #forensics #webapplicationfirewall

1

3 min read

jeffrey

Oct 26

Before You Patch: Auditing Which Junos Devices Are Actually Exposed to the October 2026 Critical Flaws

#cybersecurity #infosec #networking #security

1

4 min read

jeffrey

Oct 26

cAdvisor: 134,520 pages name it, 13,948 answer on 8080, and no fingerprint exists to check against

#security #exposure

1

4 min read

jeffrey

Oct 26

A shared cache decides whether an authenticated page is private, and `Vary` is the header that says so

#websecurity #http #caching

1

4 min read

jeffrey

Oct 25

msiexec repair mode resolves a binary path from a directory an installer wrote to

#windows #installer #privilegeescalation #configuration

3 min read

jeffrey

Oct 25

Aria Operations answers 3,440 and vRealize Operations answers 5,492: a rename that splits your own inventory

#zoomeye #attacksurface #virtualization #measurement

3 min read

jeffrey

Oct 25

Detecting and responding to BlockStrap exploitation on a Magento store

#magento #adobecommerce #rce #cve2026103849

4 min read

jeffrey

Oct 25

1,587,145 vs 1,341,669: What Two F5 Fingerprints Reveal About Exposure Counting

#zoomeye #measurement #exposure #methodology

3 min read

jeffrey

Oct 25

Detecting exploitation of the Plex timeline SSRF in server and network telemetry

#cybersecurity #infosec #security

2 min read

jeffrey

Oct 25

Two Engines, Two Numbers: Why 2,991 and 260 Describe Different Internets

#security #zoomeye #measurement #danfoss

4 min read

jeffrey

Oct 25

Snort 3 restarts and the inspection gap: what 13 Cisco fixes leave you to decide

#cisco #snort3 #intrusionprevention #cve202620043

4 min read

jeffrey

Oct 24

Two npm Bugs, One Lesson: Upgrading the Runtime Is Not Upgrading the Dependencies

#npm #jwt #pathtraversal #dependencymanagement

1

4 min read

jeffrey

Oct 24

492,113 MinIO Titles: Object Storage Is Where the Backups Live

#zoomeye #minio #objectstorage #backups

3 min read

jeffrey

Oct 24

Two CVEs, One Intrusion: Sorting Priorities When Scores Mislead

#fortinet #cve202447575 #cve202561624 #patchprioritisation

3 min read

jeffrey

Oct 24

A virtual machine escape is a workstation problem until CI shares the hypervisor

#security #vulnerabilitymanagement

4 min read

jeffrey

Oct 24

A Model Registry With an Outbound Dial: What CVE-2026-64849 Hands an Unauthenticated Caller

#mlflow #ssrf #cve202664849 #modelregistry

4 min read

jeffrey

Oct 24

Grafana Alloy's bearerTokenFile Read Any Local File and Sent It as an Authorization Header

#grafanaalloy #cve202675889 #localfileread #observability

3 min read

jeffrey

Oct 24

MoviePilot let the model decide whether a command was dangerous

#promptinjection #agents #selfhosted #rce

4 min read

jeffrey

Oct 24

TDengine: 3,216 title matches, no application fingerprint, and an empty port check

#zoomeye #timeseries #measurement

4 min read

jeffrey

Oct 23

Account hygiene is the real control for CVE-2026-96655

#vulnerability #cve202696655 #plex #ssrf

3 min read

jeffrey

Oct 23

Oracle's October CPU: six 10.0s, and why T3 is still answering on your perimeter

#security #cybersecurityarticle

4 min read

jeffrey

Oct 23

Struts dynamic method invocation is off by default, and that is not the same as gone

#security

3 min read

jeffrey

Oct 23

Counting What Is Reachable: BeyondTrust Remote Support After the Armory Castle Intrusion

#zoomeye #exposure #beyondtrust #assetinventory

4 min read

1 Week Community Wellness Streak

Writing Debut

Want to connect with jeffrey?