kozhevniko - DEV Community

kozhevniko

Oct 11

Bitwarden and self-hosted password vaults: 172,580 fingerprints, 84,687 titles

#passwordmanager #bitwarden #identity

2 min read

kozhevniko

Oct 11

Known issues to expect when you install the Exchange V2 security update

#security #exchange #microsoft

2 min read

kozhevniko

Oct 10

A refresh token with no expiry is a password that does not get rotated

#security #identity #tokens

3 min read

kozhevniko

Oct 10

AI assisted commits leak secrets at roughly twice the rate, and the fix is process rather than policy

#secretsmanagement #supplychain #aicoding #credentialrotation

2 min read

kozhevniko

Oct 10

Industrial edge vendors under measurement: 2,805,294 Zyxel, 1,884,815 Draytek and 14,144 Moxa matches

#cybersecurity #iot #networking #security

2 min read

kozhevniko

Oct 10

Low-Code AI Builders: 40,653 Flowise and 10,860 Dify Title Matches

#security #exposuremanagement #zoomeye

2 min read

kozhevniko

Oct 10

Sizing the S7comm Surface: What 262 Reachable Port 102 Services Actually Tell You

#zoomeye #ics #exposuremeasurement #s7comm

3 min read

kozhevniko

Oct 10

Syslog on 973,278 hosts: the log channel that ships across every network boundary

#security

4 min read

kozhevniko

Oct 9

CVE-2026-94545 Exploitability Deep Dive: Escaping, Native Parsing and the Non-PIE Node Build

#security #vulnerability #nextjs

2 min read

kozhevniko

Oct 9

Frigate NVR surfaces: 4,999 fingerprinted instances and what a camera console exposes

#security #videosurveillance #exposure

3 min read

kozhevniko

Oct 9

CVE-2026-62911 and 22,000 Unpatched Exchange Servers

#exchange #emailsecurity #patching #cve202662911

2 min read

kozhevniko

Oct 9

CVE-2026-93674 and the Credential Risk in Self-Hosted LLM Platforms

#security #langflow #llm #credentials

2 min read

kozhevniko

Oct 9

Configuration decides exposure: mapping the NetScaler CVEs to the way appliances are deployed (CVE-2026-88776)

#security #vulnerability #citrix #netscaler

1

3 min read

kozhevniko

Oct 9

CVE-2026-103663 sits in the model delivery path, and that is what makes it dangerous

#ollama #cve2026103663 #softwaresupplychain #aiinfrastructure

1

2 min read

kozhevniko

Oct 8

Edge Servers as the Payload Delivery Surface: Sizing nginx and WordPress Exposure

#securityevent #crypter #malwareevasion #edgeexposure

2 min read

kozhevniko

Oct 8

MikroTrick: How Two RouterOS Flaws Let Attackers Take Over MikroTik Routers Without a Password

#security #vulnerability #router #edgedevice

3 min read

kozhevniko

Oct 8

What to look for when Twenty CRM credentials leak: detection ideas for CVE-2026-105763

#security #vulnerability #twentycrm

3 min read

kozhevniko

Oct 8

Detecting Exploitation Attempts Against NetScaler CVE-2026-88779

#security #detection #netscaler #cve202688779

2 min read

kozhevniko

Oct 8

176,926 Hosts on Port 5900: VNC's Persistent Place in the Exposed Service Inventory

#zoomeye #vnc #attacksurface #remoteaccess

3 min read

kozhevniko

Oct 8

TASK#STOMP: A Windows Backdoor That Lives in Scheduled Tasks and VBS

#malware #windows #persistence #detection

2 min read

kozhevniko

Oct 7

1,393 sports-sector matches are exposure, not evidence of compromise

2 min read

kozhevniko

Oct 7

SectopRAT in Tampered Audio Software Components: A Loader That Uses the Host's Own Imports

#security #sectoprat #rat #loader

1

3 min read

kozhevniko

Oct 7

FreeSWITCH mod_verto: a 2 MiB buffer and a 10 MiB Content-Length

#vulnerability #voip #memorysafety

4 min read

kozhevniko

Oct 7

One shellcode, two names: what Volexity's UTA0560 finding says about attribution confidence

#attribution #uta0560 #apt31 #threatintelligence

4 min read

kozhevniko

Oct 6

The September 2026 KEV wave as an operations dataset, not a news cycle

#cisakev #vulnerabilitymanagement #edgesecurity

2 min read

kozhevniko

Oct 6

Apache Zeppelin on the Internet: 25,617 Fingerprint Matches and a Notebook With Cluster Credentials

#security #exposuremanagement #zoomeye

2 min read

kozhevniko

Oct 6

1,897,463 MongoDB services: how unauthenticated data stores became routine

#zoomeye #exposure #mongodb #datasecurity

1

2 min read

kozhevniko

Oct 6

6,378,556 Hosts on Port 10250: The Cluster Node Interface That Assumes a Trusted Network

#exposuremanagement #containersecurity

3 min read

kozhevniko

Oct 6

GitOps control planes: the Argo CD exposure question

#zoomeye #argocd #gitops #exposure

1

2 min read

kozhevniko

Oct 6

Group-IB's August 2026 APAC Ransomware Data: What 190 Incidents Actually Tell You

#security #ransomware #threatintelligence #apac

2 min read

kozhevniko

Oct 5

Detection and verification for CVE-2026-102795 in Apache Traffic Server

#vulnerability #apachetrafficserver #accesscontrol

2 min read

kozhevniko

Oct 5

FusionAuth: 2,411 title matches on the authentication server that issues your tokens

#zoomeye #fusionauth #identity #tokens

2 min read

kozhevniko

Oct 5

CVE-2026-80097: The Authenticator App Is a Credential Store, Not Just a Prompt

#identity #mfa #mobile #authentication

2 min read

kozhevniko

Oct 5

Container Registries and Orchestration: 57,017 Harbor and 78,059 Consul Fingerprints

#cloud #devops #docker #infrastructure

2 min read

kozhevniko

Oct 5

Drupal Contributed Modules: 36 CVEs in One September 2026 Advisory Batch

#security #drupal #vulnerability

2 min read

kozhevniko

Oct 5

Jupyter Notebooks on the Open Internet: 408,240 Body Matches

#zoomeye #attacksurface #exposure

2 min read

kozhevniko

Oct 4

Why vul.cve Returns Zero for CVE-2026-96365: Reading Exposure Data Honestly

#security #drupal #cve202696365 #zoomeye

2 min read

kozhevniko

Oct 4

Triage Order After a Credential-Exposure Advisory: What to Fix First on Fortinet Edge Devices

#security #fortinet #credentialexposure #zoomeye

6 min read

kozhevniko

Oct 4

One Console, Every Firewall: What Cisco FMC CVE-2026-20079 Teaches About Management-Plane Risk

#security #vulnerabilitymanagement #networksecurity

4 min read

kozhevniko

Oct 4

Hardening SSH Against Brute Force with Fail2ban and Rate Limiting

#ssh #hardening #linux #bruteforce

6 min read

kozhevniko

Oct 4

Windows AppContainer: a sandbox that depends on how the application is written

#securityengineering

3 min read

kozhevniko

Oct 4

What the CISA KEV Listing for CVE-2026-104286 Tells Defenders

#vulnerability #fortinet #fortimail #cve2026104286

2 min read

kozhevniko

Oct 3

Dot-Form Header Aliases: How Traefik ForwardAuth Identity Spoofing Reached Backends Before 2.11.56

#security #web #authentication #reverseproxy

3 min read

kozhevniko

Oct 3

MFP Web Management Interfaces and CVE-2026-78249: Why Reachability Decides the Risk

#vulnerability #pathtraversal #mfp #printing

3 min read

kozhevniko

Oct 3

Four Stages, One Payload: The Code Delivery Chain CERT Polska Unpacked

#androidmalware #dexloading #obfuscation #zoomeye

5 min read

kozhevniko

Oct 3

Telling Docker Daemons Apart from Other Docker-Facing Services

#docker #fingerprinting #querydesign #zoomeye

3 min read

kozhevniko

Oct 3

Container Image Provenance: Signing Is Half the Control

#security #containers #supplychain

2 min read

kozhevniko

Oct 3

The Suffix That Skipped Authentication: Kestra CVE-2026-49869 and Why Path Matching Is Not Authorisation

#security #applicationsecurity #vulnerabilitymanagement

3 min read

kozhevniko

Oct 2

A Deactivated User With a Live Token: Reading Concrete CMS CVE-2026-85387 as a Revocation Gap

#security #oauth #cms #identity

3 min read

kozhevniko

Oct 2

CVE-2026-63292: A Configuration-Dependent Stack Overflow in Apache httpd 2.4

#apache #httpd #vulnerability #modvhostalias

2 min read

kozhevniko

Oct 2

SonarQube: 92,810 title matches on the platform that holds your source code and your pipeline tokens

#exposure #codequality

2 min read

kozhevniko

Oct 2

Continuous Monitoring of Public Assets: Turning a One-Off Scan into a Change Signal

#security #geoserver #cve202436401 #attacksurface

1

3 min read

kozhevniko

Oct 2

The OAuth Grants Nobody Reviews: Governing Third-Party SaaS Access

#identity #oauth #saassecurity #thirdpartyrisk

4 min read

kozhevniko

Oct 2

Tornado 6.5.9: A Symlink, a Response Ceiling, and a Query String

#backend #cybersecurity #python #security

3 min read

kozhevniko

Oct 1

CVE-2026-96358: A Module Inventory Checklist from the CERT-BUND Record

#security #drupal #cve #vulnerability

2 min read

kozhevniko

Oct 1

Sudo and the timezone that rewrites the clock: CVE-2026-96512

#cve202696512 #sudo #privilegeescalation #environmentvariables

3 min read

kozhevniko

Oct 1

Two Flaws, One Chain: How JFrog Artifactory Was Pushed to Admin

#security #jfrog #artifactory #supplychain

4 min read

kozhevniko

Oct 1

Cross-Site Scripting in the WID-SEC-2026-3554 Batch: The CVE-2026-96369 Angle

#security #vulnerability #drupal #cve202696369

3 min read

kozhevniko

Oct 1

F5 BIG-IP APM CVE-2026-94127: an unauthenticated RCE that a hardening setting does not stop

#vulnerability #networksecurity #f5 #bigip

3 min read

kozhevniko

Oct 1

Upgrading past CVE-2026-88772: version mapping and rollout order for NetScaler ADC and Gateway

#security #vulnerability #citrix #netscaler

3 min read

1 Week Community Wellness Streak

Writing Debut

Want to connect with kozhevniko?