yutianle - DEV Community

yutianle

Oct 24

AIStore's legacy ETL API accepted Kubernetes security settings from the caller

#kubernetes #containerescape #aiinfrastructure

4 min read

yutianle

Oct 23

CVE-2026-96655: what the Plex Media Server SSRF actually exposes

#vulnerability #cve202696655 #plex #ssrf

3 min read

yutianle

Oct 23

NGINX's October fixes: five CVEs and the configuration questions that decide your exposure

#security #cybersecurityarticle

4 min read

yutianle

Oct 23

An authentication bypass on a remote-support appliance is a key to every site it manages

#security

3 min read

yutianle

Oct 23

Inside CVE-2026-109618: how PHP's out-of-memory path became a remote code execution bug

#php #remotecodeexecution #cve2026109618 #vulnerability

4 min read

yutianle

Oct 23

The Appliance Holds the Keys: Credential Blast Radius After a BeyondTrust Compromise

#zoomeye #credentials #beyondtrust #incidentresponse

4 min read

yutianle

Oct 23

CVSS 9.9 with a login: the upgrade path VeloCloud operators face for CVE-2026-114625

#vulnerability #sdwan #arista #velocloud

3 min read

yutianle

Oct 23

The .pth file that runs before your code: lessons from the LiteLLM 1.107.0 compromise

#supplychain #litellm #pypi #pthfile

5 min read

yutianle

Oct 23

Drone: 4,692 fingerprints against 26,577 titles, and a CI server that already holds your deploy keys

#security

3 min read

yutianle

Oct 23

Read-Only Was Never Harmless: Identity Lessons from CVE-2026-114625

#identity #leastprivilege #accesscontrol #arista

2 min read

yutianle

Oct 22

When the search returns nothing: reading zero and near-zero results for a niche security product

#security #zoomeyearticle

3 min read

yutianle

Oct 22

Nomad's default port answers on one host and its console appears on eleven thousand

#security #attacksurfacemanagement

4 min read

yutianle

Oct 22

GlobalProtect on macOS: How CVE-2026-0315 Turns a Local Account into Root

#macos #privilegeescalation #globalprotect #patching

4 min read

yutianle

Oct 22

What Grant Abuse Looks Like in MariaDB Logs: Detection Notes for the AL-2026-144 Flaws

3 min read

yutianle

Oct 22

Engineering Lessons from CVE-2026-0313: Safe Command Construction for Remote Query Features

#vulnerability #cortexxsoar #cve20260313

3 min read

yutianle

Oct 22

Zero Pulsar fingerprints, one 10.0 CVSS, and the management console that outlived its product

#zoomeye #apachepulsar #iotdb #cve2026105944

4 min read

yutianle

Oct 22

When a Query Returns 1,225,564 for an Appliance That Ships in Thousands: Reading Fuzzy Matching Honestly

#zoomeye #measurement #methodology #exposure

3 min read

yutianle

Oct 22

Exploited Within Two Hours: Designing Detection for the Post-Disclosure Window

#detection #strategy #incidentresponse

4 min read

yutianle

Oct 21

OpenVPN flaw FAQ: seven questions a change board will ask about 2.7.8

#openvpn #vpn #cve #vulnerabilitymanagement

2 min read

yutianle

Oct 21

Putting 271 Refrigeration Interfaces in Perspective

#ics #exposuremanagement

2 min read

yutianle

Oct 21

Patch Window Trade-Offs for CVE-2026-102037

#security #juniper #junos #srx

2 min read

yutianle

Oct 21

What a Pre-Auth RCE in srxpfe Means for SRX Segmentation Designs

#networkdesign #segmentation #juniper #cve202633792

3 min read

yutianle

Oct 21

541,960 Let's Encrypt Certificates in View: What a Certificate Field Can and Cannot Tell You

#zoomeye #tls #certificates

3 min read

yutianle

Oct 21

599 Million Apache and 313 Million nginx Matches: Where Counting Stops Being Useful

#zoomeye #measurement #riskcommunication

3 min read

yutianle

Oct 20

45 Million SMTP Services, 3,932 FortiMail Assets: Separating Protocol Exposure From Product Exposure

#zoomeye #emailsecurity #measurement

3 min read

yutianle

Oct 20

Where exposure measurement stops: reading ZoomEye counts next to CVE-2026-96951

#vulnerability #windows #cve202696951

3 min read

yutianle

Oct 20

Two Addresses and a Public Callback Service: Pivoting on the CVE-2026-110447 Indicators

#threatintelligence #indicators #nextcloud #cve2026110447

2 min read

yutianle

Oct 20

CVE-2026-70024 and the Patch Window That Cannot Slip

#cybersecurity #infosec #microsoft #security

3 min read

yutianle

Oct 20

Expired Domains, Live Brand: The Asset-Lifecycle Gap Behind Yam Store

4 min read

yutianle

Oct 19

Consul at 78,129 Matches: Service Discovery, Configuration and an Optional ACL System

#zoomeye #attacksurface #exposure

2 min read

yutianle

Oct 19

CVE-2026-89077 for platform teams: what to instrument before and after the upgrade

#infrastructure #monitoring #security #sre

3 min read

yutianle

Oct 19

Incident Response Checklist for Langflow OSS 1.0.0 Through 1.12.2

#security #langflow #incidentresponse #mitigation

2 min read

yutianle

Oct 19

CVE-2026-65660: how a validation-order flaw in SharePoint SafeControls works

#sharepoint #safecontrols #codeinjection #kev

4 min read

yutianle

Oct 18

MOVEit Transfer authentication bypass under CVE-2026-89067: what changed in 2025.1.6 and 2026.0.4

#security #vulnerability #moveit #filetransfer

3 min read

yutianle

Oct 18

23 projects in 74 minutes: what the MCP supply chain looks like from the inside

#mcp #supplychain #cve202667357 #cve202619956

3 min read

yutianle

Oct 18

Plugin4Shell: The Zero-Click RCE That Arrived Through AI Coding Agent Plugins

#supplychain #agents #developertooling

3 min read

yutianle

Oct 18

AhsayCBS CVE-2026-105134: a backup console that executes what a stranger sends

#backup #ahsay #commandinjection #kev

2 min read

yutianle

Oct 17

HashiCorp Boundary: 1,637 title matches for an access plane that brokers sessions

#zoomeye #accesscontrol #identity

2 min read

yutianle

Oct 17

CVE-2026-87799 Versus CVE-2026-85185: Symlink Replay and Unvalidated Subvolume Paths Compared

#security #vulnerability #lxd #cve202687799

3 min read

yutianle

Oct 17

Notebooks Are Unauthenticated Code Execution: Revisiting Interactive Compute Under the 2027 AI Threat Picture

#security #ai #exposure #zoomeye

2 min read

yutianle

Oct 17

703 NocoDB instances: a spreadsheet interface in front of a real database

#nocodb #database #exposure #sharing

2 min read

yutianle

Oct 17

CVE-2026-93616: Assessing Real Exposure in Check Point Deployments

#cybersecurity #infosec #security

3 min read

yutianle

Oct 17

CVE-2026-87902: Remote File Inclusion in WordPress Core, and the Scale Behind It

#wordpress #remotefileinclusion #cms #cve202687902

2 min read

yutianle

Oct 16

Modoboa: 955 application matches and 960 title matches for a mail suite behind a login

#zoomeye #modoboa #mailhosting #exposuremeasurement

2 min read

yutianle

Oct 16

OpenMetadata catalogs on the internet: 1,246 instances and the lineage they expose

#cybersecurity #database #security

1

2 min read

yutianle

Oct 16

Measuring aging IIS servers still online: risk and retirement planning

#cybersecurity #infrastructure #microsoft

5 min read

yutianle

Oct 16

SD-WAN controllers on the public internet: reading an exposure signal

#zoomeye #exposuremanagement #sdwan

3 min read

yutianle

Oct 15

A Patch Runbook for CVE-2026-62911 in Microsoft Exchange Server

#microsoftexchange #vulnerability #cve202662911 #security

1

2 min read

yutianle

Oct 15

Nineteen Fixed Releases, Sixteen Projects: Changelog Forensics for CVE-2026-96365

#security #drupal #cve202696365 #releasemanagement

2 min read

yutianle

Oct 15

Kibana Fleet Authorization Gap: What CVE-2026-102412 Leaks and Who Is Exposed

#kibana #fleetserver #authorization #cve2026102412

2 min read

yutianle

Oct 15

Citrix NetScaler CVE-2026-19490 and CVE-2026-19489: Audit Evidence for a Perimeter Patch

#security #vulnerability #citrix #netscaler

3 min read

yutianle

Oct 15

Six Questions to Ask Before You Close the GitLab Ticket

#gitlab #remediation #verification #operations

3 min read

yutianle

Oct 15

FIDO2 Account Recovery: The Gap Passwordless Rollouts Leave Open

#security #identity #mfa

3 min read

yutianle

Oct 15

Envelope encryption only helps if the key hierarchy is real

#security #applicationsecurity

1

2 min read

yutianle

Oct 14

Ceph's dashboard: 5,034 title matches on a control plane for the data layer

#zoomeye #storage #keymanagement

3 min read

yutianle

Oct 14

Weaviate at 7,856 body matches: reading a vector store's public surface

#security #attacksurface

2 min read

yutianle

Oct 14

SOCKS Proxies: 4,740,002 Answers on Port 1080 Against 805,832 Service Matches

#zoomeye #proxies #exposuremeasurement #abuse

3 min read

yutianle

Oct 14

Typosquatting and Slopsquatting: Defending the Package Install Path

#supplychain #npm #pypi #cicd

4 min read

yutianle

Oct 14

CVE-2026-85956: When Delegated MarkLogic Admins Step Outside Their Boundaries

#security #vulnerability #marklogic #cve202685947

2 min read

yutianle

Oct 13

135 Kestra Matches and 107 With HTTP: Reading Workflow Orchestrator Exposure Honestly

#security #exposuremanagement #zoomeye

1

3 min read

Writing Debut

Want to connect with yutianle?