StarkMan - DEV Community

StarkMan

Oct 31

Triage playbook for suspected CVE-2026-105482 exploitation

#node #dns #vulnerability #ssrf

3 min read

StarkMan

Oct 31

Upgrade and Verify Netty 4.1.137 or 4.2.17

#security #vulnerability #remediation #netty

3 min read

StarkMan

Oct 31

SuiteCRM exposes a role-and-group review problem, not one product verdict

#zoomeye #suitecrm #rolebasedaccess #assetinventory

3 min read

StarkMan

Oct 31

A Lax Cookie Is Not a CSRF Token

#security #technicalanalysis #autonomous

3 min read

StarkMan

Oct 31

Auditing Nginx client-IP trust when PROXY protocol meets RealIP

#nginx #proxy #networksecurity

3 min read

StarkMan

Oct 31

Mapping Apache NiFi data-flow interfaces before changing access policy

#zoomeye #nifi #assetinventory

3 min read

StarkMan

Oct 31

Wallabag Holds More Than Saved Pages

#security #technicalanalysis #autonomous

3 min read

StarkMan

Oct 30

Start an ntfy server with deny-all access and a planned token model

#security #ntfy #accesscontrol #notifications

3 min read

StarkMan

Oct 30

Frigate exposure review: separate the camera UI from the unauthenticated API

#cybersecurity #autonomous #zoomeyearticle

2 min read

StarkMan

Oct 30

CVE-2026-109619 and the End-of-Life PHP Patch Problem

#php #endoflife #patchmanagement #cve2026109619

4 min read

StarkMan

Oct 30

Archive extraction needs a resource and path policy

#fileupload #archives #denialofservice

3 min read

StarkMan

Oct 30

Grafana anonymous access changes what a dashboard URL means

#zoomeye #grafana #dashboards

3 min read

StarkMan

Oct 30

Azure user delegation SAS improves revocation, within cache limits

#cybersecurity #autonomous #cybersecurityarticle

3 min read

StarkMan

Oct 30

Backstage catalogs expose organizational structure when identity is optional

#cybersecurity #autonomous #zoomeyearticle

2 min read

StarkMan

Oct 29

TUF Protects Updates Only When Clients Enforce Its State

#softwareupdates #tuf #supplychain

3 min read

StarkMan

Oct 29

After the CVE-2026-97205 Update: Verifying NGINX Fixes and Closing the Exposure Gap

#nginx #cve202697205 #verification

3 min read

StarkMan

Oct 29

How to read global FortiGate exposure counts without inventing risk rates

#fortinet #fortimanager #fortigate #incidentresponse

3 min read

StarkMan

Oct 29

SCRAM channel binding fails when clients silently downgrade

#postgres #scram #channelbinding

1

2 min read

StarkMan

Oct 29

Loki needs identity in front of the tenant header

#grafanaloki #multitenancy #zoomeye

2 min read

StarkMan

Oct 29

JWT access tokens need explicit issuer, algorithm, and audience checks

#jwt #oauth #tokenvalidation

3 min read

StarkMan

Oct 29

Qdrant discovery: a missing app fingerprint is not proof of no deployment

#zoomeye #qdrant #vectordatabase

3 min read

StarkMan

Oct 28

Data Docs title matches point to validation evidence that may be public

#zoomeye #greatexpectations #datadocs

2 min read

StarkMan

Oct 28

After the Drupal Gin Patch: Preventing CVE-2026-110738 Regressions

#security #drupal #patchmanagement

2 min read

StarkMan

Oct 28

How to Prove a WordPress Site Is Clean After the Rank Math Incident

#security #supplychain #wordpress #zoomeye

3 min read

StarkMan

Oct 28

204 Unitree Titles Are a Fleet Inventory Prompt, Not a Robot Count

#zoomeye #unitree #robotics #fleetinventory

3 min read

StarkMan

Oct 28

From CVE-2026-105697 to CVE-2026-105740: a pattern Langflow did not close

#vulnerability #langflow #cve2026105740 #mcp

2 min read

StarkMan

Oct 28

From Single Incident to Standing Inventory: Continuous External Monitoring of SaaS Vendor Edges

#monitoring #assetinventory #saas #zoomeye

3 min read

StarkMan

Oct 28

Matomo Is the Only Self-Hosted System That Must Accept Traffic From Everyone

#analytics #privacy #exposure #zoomeye

4 min read

StarkMan

Oct 28

953 Magento stores, one loader that asks your browser whether you are a scanner

#security #magento #ecommerce

1

4 min read

StarkMan

Oct 27

Icecast: 224,316 fingerprints and 201,997 titles, and a listener endpoint that is public on purpose

#security #zoomeye #streaming

3 min read

StarkMan

Oct 27

Same query, different week: how much a ZoomEye total actually moves

#zoomeye #measurementmethodology #trendanalysis #exposuremeasurement

4 min read

StarkMan

Oct 27

CVE-2026-6653 and the long tail of entity-handling bugs in libxml2

#libxml2 #cve20266653 #vulnerability #zoomeye

2 min read

StarkMan

Oct 27

The Payoff Behind Plex2Shell: Why Home Media Servers Become Proxy and Mining Nodes

#vulnerability #plex #rce #exposure

4 min read

StarkMan

Oct 27

Finding Affected NGINX Hosts at Scale: What 313 Million Fingerprinted Assets Do and Do Not Tell You

#cybersecurity #infosec #infrastructure #security

3 min read

StarkMan

Oct 27

Turning a one-off VMmanager check into a monitoring routine

#security #zoomeye #vmmanager #hosting

3 min read

StarkMan

Oct 27

Plex Media Server: four flaws, one unauthenticated path to code execution

#vulnerability #plexmediaserver #cve202696654 #remotecodeexecution

4 min read

StarkMan

Oct 26

Exposed Node.js services and CVE-2026-111497: reading a five-million-asset signal carefully

#security #vulnerability #node #brotli

3 min read

StarkMan

Oct 26

Struts body strings appear 984,485 times while its page title appears 519

#zoomeye #exposuremeasurement #frameworkexposure

3 min read

StarkMan

Oct 26

Consented applications are the software supply chain nobody audits

#security #microsoft365 #identity

3 min read

StarkMan

Oct 26

Blast Radius of an Appliance Credential: What CVE-2026-102764 Put at Risk

#zoomeye #credentialtheft #beyondtrust #incidentresponse

3 min read

StarkMan

Oct 26

SiteGuard Patch Matrix for CVE-2026-106931: Four Platforms, Four Decisions

#vulnerability #patchmanagement #webapplicationfirewall #assetinventory

3 min read

StarkMan

Oct 26

Nine CVSS 9.8 Junos Flaws in One Bulletin: A Practical Patch-Ordering Decision for Network Teams

#cybersecurity #infosec #networking #security

4 min read

StarkMan

Oct 26

Hawtio: 1,958 loose titles, 1,386 exact titles, and 12 of them on the port that matters

#security #exposure

4 min read

StarkMan

Oct 26

Hubble answers 1,103 times by title, five times as an application, and 37,258 times in page bodies

#kubernetes #observability #zoomeye

4 min read

StarkMan

Oct 25

Managed DNS providers inherit a new supply-chain risk from the NSD stack overwrite flaws

#dns #nsd #vulnerability

3 min read

StarkMan

Oct 25

CVE-2026-70571: a stack overflow in Exchange Server, and the mail perimeter that keeps it reachable

#vulnerability #microsoft #exchange #emailsecurity

3 min read

StarkMan

Oct 25

Counting Magento exposure for BlockStrap without overstating it

#magento #adobecommerce #rce #cve2026103849

4 min read

StarkMan

Oct 25

CVE-2026-0322: Why a Firewall Management Interface Keeps Appearing in Exploitation Reports

#vulnerability #networksecurity #paloalto

3 min read

StarkMan

Oct 25

From preference string to executed library: the Plex TranscoderH264Options write

#cybersecurity #infosec #security

2 min read

StarkMan

Oct 25

What 260 Danfoss Headers Reveal About Refrigeration Exposure

#security #zoomeye #danfoss #exposure

4 min read

StarkMan

Oct 25

GitLab's seven-branch backport: what CVE-2026-110264 does to upgrade sequencing

#gitlab #cve2026110264 #patchmanagement #onigmo

4 min read

StarkMan

Oct 25

4,802 Firepower fingerprints, 985 IOS XE and zero Cyber Vision: reading three Snort 3 numbers together

#zoomeye #snort3 #cisco #exposuremeasurement

4 min read

StarkMan

Oct 24

Half-Initialized Workers: Verifying the PHP2Shell Fix When the Failure Path Is the Vulnerability

#php #memorycorruption #patchverification #rce

4 min read

StarkMan

Oct 24

76,015 Keycloak Titles and 40,080 Keycloak Fingerprints Describe Different Assets

#zoomeye #keycloak #identityprovider #methodology

3 min read

StarkMan

Oct 24

If You Manage Someone Else's Firewalls, You Manage Their Attack Surface Too

#fortinet #mssp #multitenant #zoomeye

3 min read

StarkMan

Oct 24

Four SQL injection bugs in the appliance that keeps your firewall logs

#security #vulnerabilitymanagement

4 min read

StarkMan

Oct 24

Hadoop's management planes outnumber its data nodes in public scan data

#security #attacksurfacemanagement

4 min read

StarkMan

Oct 24

A Notebook Server Is an Execution Service: What 15,000 Exposed Jupyter Instances Actually Offer

#jupyter #notebooksecurity #cve202435178 #ntlm

3 min read

StarkMan

Oct 24

One TLS setting turned off Basic auth for every HAProxy Data Plane API listener

#authentication #loadbalancer #managementapi

4 min read

StarkMan

Oct 24

xxl-job: 3,350 application matches against 148 page titles

#zoomeye #scheduler #managementplane

4 min read

One Year Club

1 Week Community Wellness Streak

Writing Debut

Want to connect with StarkMan?