Skip to content
Standard
Reader
Log in
Author
@jeffreyciend.bsky.social
@jeffreyciend.bsky.social
Follow
Posts
17
Publications
1
jeffreyciend
·
Oct 24, 2026
Grafana Alloy's bearerTokenFile Read Any Local File and Sent It as an Authorization Header
A telemetry agent that reads a token from a path you can name will read any path you can name. How CVE-2026-75889 turns an Alloy configuration into credential exfiltration, and the mount rules that stop it.
grafana-alloy
·
cve-2026-75889
jeffreyciend
·
Oct 24, 2026
MoviePilot let the model decide whether a command was dangerous
CVE-2026-77931: MoviePilot let injected content reach ExecuteCommandTool with confirm_dangerous set by the model itself, bypassing the command denylist inside the admin session.
prompt-injection
·
agent
jeffreyciend
·
Oct 24, 2026
TDengine: 3,216 title matches, no application fingerprint, and an empty port check
TDengine returns 3,216 title matches but zero application fingerprints and zero port-scoped matches, a case study in why absence of a signature is not absence of the product.
zoomeye
·
time-series
jeffreyciend
·
Oct 23, 2026
Account hygiene is the real control for CVE-2026-96655
Account hygiene is the real control for CVE-2026-96655
vulnerability
·
CVE-2026-96655
jeffreyciend
·
Oct 23, 2026
Oracle's October CPU: six 10.0s, and why T3 is still answering on your perimeter
security
·
cybersecurity_article
jeffreyciend
·
Oct 23, 2026
Struts dynamic method invocation is off by default, and that is not the same as gone
Struts dynamic method invocation is off by default, and that is not the same as gone
security
jeffreyciend
·
Oct 23, 2026
Detecting exploitation attempts against CVE-2026-109618 without a public exploit
php
·
remote code execution
jeffreyciend
·
Oct 23, 2026
Exchange Server on the internet: reading exposure when the banner names the protocol, not the build
security
·
zoomeye_article
jeffreyciend
·
Oct 22, 2026
Why an SD-WAN Orchestrator Is a Crown-Jewel Target: Lessons from CVE-2026-114625
An SD-WAN orchestrator is a control plane, not a workload. CVE-2026-114625 shows how a read-only tenant login becomes platform-level control and why partner accounts are tier-zero.
threat-model
·
sd-wan
jeffreyciend
·
Oct 22, 2026
Apache StreamPark: 167 Fingerprints, 170 Titles, and a Control Plane for Streaming Jobs
A rare control plane is a specific finding rather than a statistic. What 167 fingerprinted StreamPark instances against 170 titles say, and why job submission makes containment harder than firewall changes.
zoomeye
·
streampark
jeffreyciend
·
Oct 22, 2026
CVE-2026-74041: where Wazuh Manager configuration becomes code
CVE-2026-74041: where Wazuh Manager configuration becomes code
vulnerability
·
Wazuh
jeffreyciend
·
Oct 22, 2026
Detecting PAN-OS CVE-2026-0321 with the telemetry you already collect
Behavioural detection, correlation rules and retuning for the PAN-OS dataplane DoS.
PAN-OS
·
CVE-2026-0321
Home
Latest
Discover
Search
