Skip to content

I enjoy tinkering with networks, systems, and anything that lets me understand how things work.

0Readers
17Posts
todayLast active
ZooKeeper's ACL checks were bypassed twice, in code paths that rarely get reviewed
Oct 24, 2026
ZooKeeper's ACL checks were bypassed twice, in code paths that rarely get reviewed
securityvulnerability-management
Docassemble: 584 Fingerprints Against 2,899 Titles, and a Guided Interview That Collects What Courts Ask For
Oct 24, 2026
A guided interview collects what a court filing needs, and none of it can be rotated. What 584 fingerprinted Docassemble instances against 2,899 titles say about a small surface with unusually durable data.
zoomeyedocassemble
A Windows service that grants privilege without asking who is calling
Oct 24, 2026
CVE-2026-85884 is a missing authentication check in the Windows Health and Optimized Experiences Service that lets a local attacker turn ordinary user code into administrative privilege.
windowsprivilege-escalation
Docker and NAS deployments: the CVE-2026-96655 upgrade gap
Oct 23, 2026
Docker and NAS deployments: the CVE-2026-96655 upgrade gap
vulnerabilityCVE-2026-96655
A path traversal on a mail gateway is a write primitive, not a file-read bug
Oct 23, 2026
A path traversal on a mail gateway is a write primitive, not a file-read bug
security
Apache Guacamole: 63 application fingerprints, 4,192 page titles, and a gateway that brokers every session
Oct 23, 2026
Apache Guacamole: 63 application fingerprints, 4,192 page titles, and a gateway that brokers every session
security
CVE-2026-109619: the PHP flaw that outlives its own request
Oct 23, 2026
phpremote code execution
PocketBase: 66 fingerprints and 17 hosts on its default port describe a young product, not a small risk
Oct 23, 2026
PocketBase: 66 fingerprints and 17 hosts on its default port describe a young product, not a small risk
security
VeloCloud Orchestrator Patch Triage: Three Release Trains, One Critical SQL Injection
Oct 23, 2026
Patch triage for CVE-2026-114625 across VeloCloud Orchestrator 5.2, 6.1 and 6.4 trains, including the stale-patch trap from earlier 2026 VCO fixes.
patch-managementvulnerability-management
The query returned zero, and that is the finding
Oct 22, 2026
The query returned zero, and that is the finding
securityattack-surface-management
Six MariaDB Branches, Five CVEs: Building a Patch Plan That Actually Closes Them
Oct 22, 2026
Risk Register Decisions for CVE-2026-0315: Scoring a Local macOS Bug Without Inflating It
Oct 22, 2026
How to record CVE-2026-0315 in a risk register with the right modifiers, defensible treatment options and explicit review triggers.
risk-managementmacos