Skip to content
Standard Reader
Log in
jeffreyciend

jeffreyciend

@jeffreyciend.bsky.social
Subscribe

Deep into tech and security, constantly experimenting.

0Readers
17Posts
todayLast active
Grafana Alloy's bearerTokenFile Read Any Local File and Sent It as an Authorization Header
Oct 24, 2026
A telemetry agent that reads a token from a path you can name will read any path you can name. How CVE-2026-75889 turns an Alloy configuration into credential exfiltration, and the mount rules that stop it.
grafana-alloycve-2026-75889
MoviePilot let the model decide whether a command was dangerous
Oct 24, 2026
CVE-2026-77931: MoviePilot let injected content reach ExecuteCommandTool with confirm_dangerous set by the model itself, bypassing the command denylist inside the admin session.
prompt-injectionagent
TDengine: 3,216 title matches, no application fingerprint, and an empty port check
Oct 24, 2026
TDengine returns 3,216 title matches but zero application fingerprints and zero port-scoped matches, a case study in why absence of a signature is not absence of the product.
zoomeyetime-series
Account hygiene is the real control for CVE-2026-96655
Oct 23, 2026
Account hygiene is the real control for CVE-2026-96655
vulnerabilityCVE-2026-96655
Oracle's October CPU: six 10.0s, and why T3 is still answering on your perimeter
Oct 23, 2026
securitycybersecurity_article
Struts dynamic method invocation is off by default, and that is not the same as gone
Oct 23, 2026
Struts dynamic method invocation is off by default, and that is not the same as gone
security
Detecting exploitation attempts against CVE-2026-109618 without a public exploit
Oct 23, 2026
phpremote code execution
Exchange Server on the internet: reading exposure when the banner names the protocol, not the build
Oct 23, 2026
securityzoomeye_article
Why an SD-WAN Orchestrator Is a Crown-Jewel Target: Lessons from CVE-2026-114625
Oct 22, 2026
An SD-WAN orchestrator is a control plane, not a workload. CVE-2026-114625 shows how a read-only tenant login becomes platform-level control and why partner accounts are tier-zero.
threat-modelsd-wan
Apache StreamPark: 167 Fingerprints, 170 Titles, and a Control Plane for Streaming Jobs
Oct 22, 2026
A rare control plane is a specific finding rather than a statistic. What 167 fingerprinted StreamPark instances against 170 titles say, and why job submission makes containment harder than firewall changes.
zoomeyestreampark
CVE-2026-74041: where Wazuh Manager configuration becomes code
Oct 22, 2026
CVE-2026-74041: where Wazuh Manager configuration becomes code
vulnerabilityWazuh
Detecting PAN-OS CVE-2026-0321 with the telemetry you already collect
Oct 22, 2026
Behavioural detection, correlation rules and retuning for the PAN-OS dataplane DoS.
PAN-OSCVE-2026-0321