Skip to content

Standard Reader

sorrelthorncroft

sorrelthorncroft

@sorrelthorncroft.bsky.social

Network security enthusiast. Focus on infrastructure hardening, log analysis and defensive tradecraft.

0Readers

18Posts

todayLast active

Zimbra's sharing features are an unauthenticated injection surface

Zimbra's sharing features are an unauthenticated injection surface

securityvulnerability-management

Chevereto: 8,818 Fingerprint Matches on an Image Host, and 4,412 Titles That Agree With It

An image host grows without a ceiling and often holds personal media. What 8,818 fingerprinted Chevereto deployments and 4,412 matching titles indicate, and the three patterns that change the risk.

zoomeyechevereto

DataEase: 9,832 Fingerprints Against 1,246 Titles, and the JDBC Credential in the Datasource Form

A BI platform is a credential registry with a dashboard on top. What 9,832 fingerprinted DataEase deployments against 1,246 titles say about stored datasource access and the three paths that matter.

zoomeyedataease

Four attributes left out of PraisonAI's subprocess blocklist

CVE-2026-39888: PraisonAI's subprocess blocklist omitted four frame-traversal attributes, letting caught exceptions carry model-generated code back to the real builtins dictionary.

sandbox-escapepython

Designing a reverse proxy that survives a Plex SSRF

Designing a reverse proxy that survives a Plex SSRF

vulnerabilityCVE-2026-96655

GitLab's second perfect score in nine days: why anyone who patched on 12 October is still exposed

securitycybersecurity_article

Patching CVE-2026-109618 across a fleet: where PHP actually hides in your inventory

phpremote code execution

Hunting VeloCloud Orchestrator exploitation: what CVE-2026-114625 leaves in the logs

Technical analysis of CVE-2026-114625 in Arista VeloCloud Orchestrator.

vulnerabilitysd-wan

Appwrite: 5,102 titles, 4,094 fingerprints, and 531 hosts on the default web port

Appwrite: 5,102 titles, 4,094 fingerprints, and 531 hosts on the default web port

Reading the 9.9: What CVSS Tells You About CVE-2026-114625, and What It Does Not

CVE-2026-114625 scores 9.9 on CVSS 3.1 and 9.4 on CVSS 4.0. Here is what each vector actually encodes, what the low-privilege assumption hides, and what the score cannot answer.

cvssrisk-scoring

You can measure a cipher suite. You cannot measure a crypto library build

securityzoomeye_article

FortiAnalyzer's collection port is the internet's most crowded number

FortiAnalyzer's collection port is the internet's most crowded number

securityattack-surface-management