Skip to content
Standard Reader
Log in
@facilishz.bsky.social
Author

@facilishz.bsky.social

@facilishz.bsky.social
Follow
facilishz
facilishzOct 24, 2026
ZooKeeper's ACL checks were bypassed twice, in code paths that rarely get reviewed
ZooKeeper's ACL checks were bypassed twice, in code paths that rarely get reviewed
securityvulnerability-management
facilishz
facilishzOct 24, 2026
Docassemble: 584 Fingerprints Against 2,899 Titles, and a Guided Interview That Collects What Courts Ask For
A guided interview collects what a court filing needs, and none of it can be rotated. What 584 fingerprinted Docassemble instances against 2,899 titles say about a small surface with unusually durable data.
zoomeyedocassemble
facilishz
facilishzOct 24, 2026
A Windows service that grants privilege without asking who is calling
CVE-2026-85884 is a missing authentication check in the Windows Health and Optimized Experiences Service that lets a local attacker turn ordinary user code into administrative privilege.
windowsprivilege-escalation
facilishz
facilishzOct 23, 2026
Docker and NAS deployments: the CVE-2026-96655 upgrade gap
Docker and NAS deployments: the CVE-2026-96655 upgrade gap
vulnerabilityCVE-2026-96655
facilishz
facilishzOct 23, 2026
A path traversal on a mail gateway is a write primitive, not a file-read bug
A path traversal on a mail gateway is a write primitive, not a file-read bug
security
facilishz
facilishzOct 23, 2026
Apache Guacamole: 63 application fingerprints, 4,192 page titles, and a gateway that brokers every session
Apache Guacamole: 63 application fingerprints, 4,192 page titles, and a gateway that brokers every session
security
facilishz
facilishzOct 23, 2026
CVE-2026-109619: the PHP flaw that outlives its own request
phpremote code execution
facilishz
facilishzOct 23, 2026
PocketBase: 66 fingerprints and 17 hosts on its default port describe a young product, not a small risk
PocketBase: 66 fingerprints and 17 hosts on its default port describe a young product, not a small risk
security
facilishz
facilishzOct 23, 2026
VeloCloud Orchestrator Patch Triage: Three Release Trains, One Critical SQL Injection
Patch triage for CVE-2026-114625 across VeloCloud Orchestrator 5.2, 6.1 and 6.4 trains, including the stale-patch trap from earlier 2026 VCO fixes.
patch-managementvulnerability-management
facilishz
facilishzOct 22, 2026
The query returned zero, and that is the finding
The query returned zero, and that is the finding
securityattack-surface-management
facilishz
facilishzOct 22, 2026
Six MariaDB Branches, Five CVEs: Building a Patch Plan That Actually Closes Them
security
facilishz
facilishzOct 22, 2026
Risk Register Decisions for CVE-2026-0315: Scoring a Local macOS Bug Without Inflating It
How to record CVE-2026-0315 in a risk register with the right modifiers, defensible treatment options and explicit review triggers.
risk-managementmacos