kozhevniko - DEV Community

kozhevniko

Oct 4

Hardening SSH Against Brute Force with Fail2ban and Rate Limiting

#ssh #hardening #linux #bruteforce

6 min read

kozhevniko

Oct 4

Windows AppContainer: a sandbox that depends on how the application is written

#securityengineering

3 min read

kozhevniko

Oct 4

What the CISA KEV Listing for CVE-2026-104286 Tells Defenders

#vulnerability #fortinet #fortimail #cve2026104286

2 min read

kozhevniko

Oct 3

Dot-Form Header Aliases: How Traefik ForwardAuth Identity Spoofing Reached Backends Before 2.11.56

#security #web #authentication #reverseproxy

3 min read

kozhevniko

Oct 3

MFP Web Management Interfaces and CVE-2026-78249: Why Reachability Decides the Risk

#vulnerability #pathtraversal #mfp #printing

3 min read

kozhevniko

Oct 3

Four Stages, One Payload: The Code Delivery Chain CERT Polska Unpacked

#androidmalware #dexloading #obfuscation #zoomeye

5 min read

kozhevniko

Oct 3

Telling Docker Daemons Apart from Other Docker-Facing Services

#docker #fingerprinting #querydesign #zoomeye

3 min read

kozhevniko

Oct 3

Container Image Provenance: Signing Is Half the Control

#security #containers #supplychain

2 min read

kozhevniko

Oct 3

The Suffix That Skipped Authentication: Kestra CVE-2026-49869 and Why Path Matching Is Not Authorisation

#security #applicationsecurity #vulnerabilitymanagement

3 min read

kozhevniko

Oct 2

A Deactivated User With a Live Token: Reading Concrete CMS CVE-2026-85387 as a Revocation Gap

#security #oauth #cms #identity

3 min read

kozhevniko

Oct 2

CVE-2026-63292: A Configuration-Dependent Stack Overflow in Apache httpd 2.4

#apache #httpd #vulnerability #modvhostalias

2 min read

kozhevniko

Oct 2

SonarQube: 92,810 title matches on the platform that holds your source code and your pipeline tokens

#exposure #codequality

2 min read

kozhevniko

Oct 2

Continuous Monitoring of Public Assets: Turning a One-Off Scan into a Change Signal

#security #geoserver #cve202436401 #attacksurface

1

3 min read

kozhevniko

Oct 2

The OAuth Grants Nobody Reviews: Governing Third-Party SaaS Access

#identity #oauth #saassecurity #thirdpartyrisk

4 min read

kozhevniko

Oct 2

Tornado 6.5.9: A Symlink, a Response Ceiling, and a Query String

#backend #cybersecurity #python #security

3 min read

kozhevniko

Oct 1

CVE-2026-96358: A Module Inventory Checklist from the CERT-BUND Record

#security #drupal #cve #vulnerability

2 min read

kozhevniko

Oct 1

Sudo and the timezone that rewrites the clock: CVE-2026-96512

#cve202696512 #sudo #privilegeescalation #environmentvariables

3 min read

kozhevniko

Oct 1

Two Flaws, One Chain: How JFrog Artifactory Was Pushed to Admin

#security #jfrog #artifactory #supplychain

4 min read

kozhevniko

Oct 1

Cross-Site Scripting in the WID-SEC-2026-3554 Batch: The CVE-2026-96369 Angle

#security #vulnerability #drupal #cve202696369

3 min read

kozhevniko

Oct 1

F5 BIG-IP APM CVE-2026-94127: an unauthenticated RCE that a hardening setting does not stop

#vulnerability #networksecurity #f5 #bigip

3 min read

kozhevniko

Oct 1

Upgrading past CVE-2026-88772: version mapping and rollout order for NetScaler ADC and Gateway

#security #vulnerability #citrix #netscaler

3 min read

kozhevniko

Sep 30

Secure Private Access and managed services: scoping CVE-2026-88771 beyond the appliance

#security #vulnerability #citrix #netscaler

3 min read

kozhevniko

Sep 30

Managed file transfer keeps returning to the news, and the findings look similar each time

#managedfiletransfer #moveit #sharefile #authenticationbypass

2 min read

kozhevniko

Sep 30

Penetration Test Findings That Never Get Fixed: Running a Retest Programme

#security #vulnerabilitymanagement #governance

2 min read

kozhevniko

Sep 30

When the AI Gateway Becomes the Weakest Link: Command Execution in LiteLLM's MCP Test Endpoints

#cybersecurity #aiinfrastructure #vulnerabilitymanagement #litellm

4 min read

kozhevniko

Sep 30

CVE-2026-32996 Under Active Exploitation: What Defenders Should Do Now

#security #vulnerability #veeam #privilegeescalation

2 min read

kozhevniko

Sep 30

350,527 Elasticsearch Matches and 161,615 Kibana Matches: Where Logging Data Actually Lives

#zoomeye #logging #elasticsearch #exposure

2 min read

kozhevniko

Sep 29

Small Numbers, Real Findings: AWX, NiFi, Pulsar and CockroachDB

#zoomeye #awx #apachenifi #cockroachdb

3 min read

kozhevniko

Sep 29

Assessing CVE-2026-86510: Severity, Reachability and the Limits of the Public Record

#security #vulnerability #router #dlink

2 min read

kozhevniko

Sep 29

From p=none to Enforcement: A Working Sequence for DMARC Rollout

#security #defensivepractice

3 min read

kozhevniko

Sep 29

983,992 Indexed FortiGate Instances: Reading an Edge-Appliance Count Against CVE-2025-25249

#exposuremanagement #networksecurity

3 min read

kozhevniko

Sep 29

Request smuggling in NetScaler: why the backend's parsing rules decide the impact

#vulnerability #citrix #netscaler #http

2 min read

kozhevniko

Sep 29

Why moderately critical advisories like CVE-2026-96360 get postponed

#drupal #webform #cve202696360 #xss

2 min read

kozhevniko

Sep 28

Where the Panels Live: Network Footprint Patterns of Exposed AI Gateways After the CISA Advisory

#security #zoomeye #ai #networkfootprint

1

1 min read

kozhevniko

Sep 28

Why stored XSS in Drupal Webform (CVE-2026-96367) reaches other users

#security #vulnerability #drupal #webform

2 min read

kozhevniko

Sep 28

Authentication and Privilege Escalation Paths in the Drupal Extension Advisory WID-SEC-2026-3554

#security #drupal #vulnerability

1

2 min read

kozhevniko

Sep 28

Grafana Dashboards on the Internet: A Title Match Beats a Fingerprint Here

#grafana #exposure #monitoring

3 min read

kozhevniko

Sep 28

Why CVE-2026-96364 cannot be mapped to a single Drupal module from public records

#security #drupal #cve202696364 #contributedmodules

3 min read

kozhevniko

Sep 28

Assessing CVE-2026-67278 Risk: Why Trust Failures Outrank Their CVSS Label

#vulnerability #mikrotik #routeros #risk

1

2 min read

kozhevniko

Sep 27

CVE-2026-96359 Explained for Defenders: What WID-SEC-2026-3554 Does and Does Not Tell You

#security #drupal #detection #cve202696359

1

3 min read

kozhevniko

Sep 27

CVE-2026-48842: Pre-Auth SQL Injection in Roundcube's virtuser_query Plugin

#vulnerability #webmail #sqlinjection #zoomeye

1

4 min read

kozhevniko

Sep 27

OpenCTI Readers Can Open Cases: Inside CVE-2026-76822's Missing Capability Check

#cybersecurity #infosec #security

1

3 min read

kozhevniko

Sep 27

Measuring Internet-Exposed Email Security Gateways With ZoomEye

#security #zoomeye #exposure #emailsecurity

3 min read

kozhevniko

Sep 27

174 Unauthenticated Docker Daemons and the Control-Plane Exposure Behind Them

#zoomeye #containersecurity #exposuremeasurement #docker

3 min read

kozhevniko

Sep 27

Nomad's API without an access control list

#zoomeye #nomad #scheduler #exposure

2 min read

kozhevniko

Sep 26

What the September 2026 IBM advisory means for teams running Langflow OSS in production

#vulnerability #langflow #ibm #remotecodeexecution

1

2 min read

kozhevniko

Sep 26

5,873,669 Hosts on Port 1433: The Database Port That Still Faces the Internet

#exposuremanagement #databasesecurity

1

3 min read

kozhevniko

Sep 26

SAP's September 2026 patch day: a CVSS 10.0 in the passport layer

#sap #patchmanagement #cve202644756 #erp

4 min read

kozhevniko

Sep 26

152,655 Matches for ownCloud and the CVE That Matches It Exactly

#security #attacksurface #zoomeye

1

3 min read

kozhevniko

Sep 26

Sizing the Zimbra Perimeter That Email Attackers Actually Touch

#zimbra #cve202566376 #exposuremanagement #zoomeye

1

3 min read

kozhevniko

Sep 26

Apache Tomcat 11.0.26 Closes an HTTP/2 Header Mix-Up Regression: CVE-2026-86350

#security #vulnerability #apachetomcat #cve202686350

1

3 min read

kozhevniko

Sep 25

Stored XSS as a Privilege Ladder: CVE-2026-75684, CVE-2026-75689 and CVE-2026-75697 in Adobe Connect

#adobeconnect #cve202675684 #storedxss #privilegeescalation

3 min read

kozhevniko

Sep 25

5,497 Matches for SonicWall SMA1000: Remote Access Appliances That Administrators Already Trust

#security #attacksurface #zoomeye

2 min read

kozhevniko

Sep 25

132,158 Observable Magento Stores: Sizing the Population Exposed in the StyleSmuggler Window

#zoomeye #magento #exposuremeasurement #ecommerce

2 min read

kozhevniko

Sep 25

Apache Tomcat: 5,853,642 Fingerprint Matches and 10,191 Manager Pages

#tomcat #managerapplication #deployment #exposuremeasurement

2 min read

kozhevniko

Sep 25

Home Assistant at Internet Scale: 2.7 Million Fingerprint Matches and the Automation Control Plane

#homeassistant #iot #homeautomation #exposure

4 min read

kozhevniko

Sep 25

From Internet-Facing Firewall to Root Shell: Why CVE-2026-20324 Matters

#cisco #firewall #cve202620324 #rootrce

2 min read

kozhevniko

Sep 24

Citrix NetScaler CVE-2026-19490: Fifteen Days From Patch to Exploitation

#cybersecurity #authenticationbypass #edgedevices

3 min read

kozhevniko

Sep 24

CVE-2026-87886: Insecure File Permissions in the Acronis Backup Plugin on Shared Hosting

#security #vulnerability #exploitedinthewild

3 min read

kozhevniko

Sep 24

CVE-2026-77762 and the HTTP/2 Request-Mixup Family in Apache Tomcat

#apachetomcat #cve202677762 #requestmixup #cve202686350

2 min read

1 Week Community Wellness Streak

Writing Debut

Want to connect with kozhevniko?