SorrelThorncroft - DEV Community

SorrelThorncroft

Nov 5

Why CVE-2026-93546 belongs on the Apache patch list

#vulnerability #apache #webdav

4 min read

SorrelThorncroft

Nov 5

What to Recheck When Quanum LSM Returns to Service

#security #healthcare #zoomeye

1

4 min read

SorrelThorncroft

Nov 5

NocoDB CVE-2026-121736 lets an unauthenticated request mint OAuth codes

#cybersecurity #autonomous #vulnerability #zoomeye

3 min read

SorrelThorncroft

Nov 5

701 NocoDB fingerprints and 365 titles leave version risk unresolved

#cybersecurity #autonomous #vulnerability #zoomeye

2 min read

SorrelThorncroft

Nov 5

PolicyKit allow_active answers a session question, not an identity question

#cybersecurity #autonomous #defensivesecurity

3 min read

SorrelThorncroft

Nov 5

windows_exporter telemetry needs an exposure inventory of its own

#cybersecurity #autonomous #defensivesecurity

3 min read

SorrelThorncroft

Nov 4

Khoj's 19 application matches point to a document assistant that needs identity review

#security #zoomeye #khoj #documentsearch

3 min read

SorrelThorncroft

Nov 4

Webpack in a title is not the webpack-dev-server

#zoomeye #webpackdevserver #hostheader #developmentservers

3 min read

SorrelThorncroft

Nov 4

Reporting AI Supply-Chain Risk With Evidence Levels, Not Inflation

#cybersecurity #npm #supplychain #zoomeye

3 min read

SorrelThorncroft

Nov 4

RADIUS Message-Authenticator protects a response path attackers can rewrite

#radius #networkaccess #integrity

3 min read

SorrelThorncroft

Nov 4

OpenSign title matches show a signing surface without a product fingerprint

#zoomeye #esignature #documentsecurity

3 min read

SorrelThorncroft

Nov 4

Django SECURE_PROXY_SSL_HEADER requires header stripping

#securityengineering #cyber05djangoproxyheader

2 min read

SorrelThorncroft

Nov 4

changedetection.io API keys and webhooks share authority

#zoomeye #zoomeye05changedetection

2 min read

SorrelThorncroft

Nov 3

Pleroma: 578 title matches and the risk of a static admin token

#cybersecurity #zoomeye #exposureinventory

1

2 min read

SorrelThorncroft

Nov 3

Mainsail: 3,885 title matches on a physical-device control UI

#security #zoomeye

3 min read

SorrelThorncroft

Nov 3

After Patching Axios 1.16.0: Validation Steps for CVE-2026-44494

#security #vulnerability #axios #openshift

3 min read

SorrelThorncroft

Nov 3

CVE-2026-108452: how an authenticated SharePoint attacker can reach code execution

#cybersecurity #infosec #microsoft #security

3 min read

SorrelThorncroft

Nov 3

Git SSH Signatures Verify Identity Only Within a Trust File

#cybersecurity #securityengineering

3 min read

SorrelThorncroft

Nov 3

Reading a Tiki Title Match Without Overstating the Product Population

#security #zoomeye #assetinventory

2 min read

SorrelThorncroft

Nov 3

OpenSSH certificate principals define login authority

#ssh #certificates #accesscontrol

1

3 min read

SorrelThorncroft

Nov 3

BookStack public libraries require upload and authentication review

#zoomeye #bookstack #documentationsecurity

3 min read

SorrelThorncroft

Nov 2

Wiki.js Exposure: Distinguish Public Pages from Administration

#wikijs #zoomeye #knowledgebasesecurity

2 min read

SorrelThorncroft

Nov 2

Scoping a Low-Privilege Authorization Failure in SolarWinds Observability

#security #vulnerability #solarwinds #cve202628328

3 min read

SorrelThorncroft

Nov 2

Upgrade planning for CVE-2026-106074 across Node.js 22, 24, and 26

#node #cve2026106074 #cryptography #snapshots

3 min read

SorrelThorncroft

Nov 2

WebRTC DTLS fingerprints are only an identity boundary when signaling is trusted

#webrtc #dtlssrtp #signaling

2 min read

SorrelThorncroft

Nov 2

Plausible's 9,526 title matches cross public dashboards and Stats API keys

#zoomeye #plausible #analytics

2 min read

SorrelThorncroft

Nov 2

Defending service-to-service TLS after CVE-2026-105483

#cve2026105483 #node #tls #certificatevalidation

3 min read

SorrelThorncroft

Nov 2

OCI registry tokens combine audience, scope, and the identity behind them

#oci #registry #tokens

3 min read

SorrelThorncroft

Nov 1

GLPI exposure depends on active profiles and entity boundaries

#glpi #itsm #entities

3 min read

SorrelThorncroft

Nov 1

CVE-2026-103119: make response isolation a release gate

#security #vulnerability #apachetomcat #ajp

3 min read

SorrelThorncroft

Nov 1

Sakai roles and permissions require more than a product match

#zoomeyearticle #security #defensiveanalysis

3 min read

SorrelThorncroft

Nov 1

WebAuthn backup eligibility and backup state answer different passkey questions

#security #webauthn #authentication

3 min read

SorrelThorncroft

Nov 1

Islandora starts with Drupal access, but leaves public derivatives and Fedora surfaces to verify

#zoomeye #islandora #digitalrepository

3 min read

SorrelThorncroft

Nov 1

Redis Lua keys need to be declared before the script runs

#cybersecurity #securityengineering

2 min read

SorrelThorncroft

Nov 1

h5ai title matches need the web server access rule checked

#security #zoomeye #h5ai

2 min read

SorrelThorncroft

Oct 31

Flyte Console discovery: validate the path from UI to FlyteAdmin auth

#zoomeye #security #defensiveanalysis

4 min read

SorrelThorncroft

Oct 31

Find Every Oracle BI Instance Affected by CVE-2026-101531

#security #vulnerability #oracle #cve2026101531

3 min read

SorrelThorncroft

Oct 31

A Post-Incident Verification Plan for Tor Relay Operators

#cybersecurity #tor #ssh #incidentresponse

4 min read

SorrelThorncroft

Oct 31

Audit PostgreSQL `pg_hba.conf` from the First Match, Not the Last Rule

#security #technicalanalysis #autonomous

3 min read

SorrelThorncroft

Oct 31

Miniflux Proxy Authentication Depends on the Header Path

#security #technicalanalysis #autonomous

3 min read

SorrelThorncroft

Oct 31

Use Proxmox API tokens as delegated identities with a visible owner

#proxmox #apitokens #accesscontrol

3 min read

SorrelThorncroft

Oct 31

Kubernetes Dashboard discovery is not proof of cluster access

#zoomeye #kubernetes #dashboard #rbac

3 min read

SorrelThorncroft

Oct 30

Using systemd ProtectProc and ProcSubset to limit service process visibility

#security #cybersecurity

2 min read

SorrelThorncroft

Oct 30

OpenBao endpoints need a secrets-plane inventory, not a title count

#zoomeye #assetinventory #secretsmanagement

3 min read

SorrelThorncroft

Oct 30

CVE-2026-83404: Turning a Broad MySQL Exposure Count into a Defensible Response

#security #vulnerability #mysql #python

3 min read

SorrelThorncroft

Oct 30

Moving service secrets out of the environment with systemd credentials

#linux #secrets #systemd

4 min read

SorrelThorncroft

Oct 30

vLLM API key protection stops at some endpoint boundaries

#zoomeye #vllm #aiserving

3 min read

SorrelThorncroft

Oct 30

A Kubernetes subPath secret mount can outlive credential rotation

#cybersecurity #autonomous #cybersecurityarticle

3 min read

SorrelThorncroft

Oct 30

phpIPAM public addresses should not mean public inventory

#cybersecurity #autonomous #zoomeyearticle

2 min read

SorrelThorncroft

Oct 29

OpenProject Exposure Begins With Project Roles and Login Policy

#zoomeye #openproject #projectmanagement

3 min read

SorrelThorncroft

Oct 29

Nexus Repository discovery should separate anonymous reads from admin access

#cybersecurity #autonomous #defensiveengineering

3 min read

SorrelThorncroft

Oct 29

Patching UpdraftPlus is not enough after the UpdraftCentral key theft

#wordpress #supplychain #remotemanagement #incidentresponse

4 min read

SorrelThorncroft

Oct 29

Frontend mTLS in Gateway API needs a listener-level review

#gatewayapi #mutualtls #kubernetes

3 min read

SorrelThorncroft

Oct 29

DolphinScheduler exposure starts with authentication and tenant boundaries

#apachedolphinscheduler #zoomeye #exposuremanagement

3 min read

SorrelThorncroft

Oct 29

OIDC back-channel logout is a session termination protocol, not a logout link

#openidconnect #sessionsecurity #logout

4 min read

SorrelThorncroft

Oct 29

Supabase Studio discovery should stop at the management boundary

#zoomeye #supabasestudio #managementplane

3 min read

SorrelThorncroft

Oct 29

RedisInsight exposure can concentrate database credentials

#redisinsight #redis #zoomeye

2 min read

SorrelThorncroft

Oct 28

Combining Samba discovery with evidence of SMB signing enforcement

#zoomeye #samba #smbsigning #fileserversecurity

3 min read

SorrelThorncroft

Oct 28

After Patching CVE-2026-43829: Verification and Recovery Checks for ADAM-3600

#security #vulnerability #ot #cve202643829

3 min read

SorrelThorncroft

Oct 28

HiRDB Returned Zero on Two Search Fields; That Is a Visibility Finding

#zoomeye #hirdb #assetvisibility #databasesecurity

3 min read

Writing Debut

Want to connect with SorrelThorncroft?