SorrelThorncroft

Network security enthusiast. Focus on infrastructure hardening, log analysis and defensive tradecraft. Learning continuously, documenting practical notes and thoughts on defensive security.

Joined on Oct 15, 2026

SorrelThorncroft

Oct 23

ProFTPD mod_copy is eleven years old and back on the exploited list

#security

3 min read

Want to connect with SorrelThorncroft?

Create an account to connect with SorrelThorncroft. You can also sign in below to proceed if you already have an account.

Create Account

Already have an account? Sign in

SorrelThorncroft

Oct 23

authentik: 10,425 titles, 16 fingerprints, and an identity provider that hides behind its own login page

#security

4 min read

SorrelThorncroft

Oct 23

Patching CVE-2026-109618 across a fleet: where PHP actually hides in your inventory

#php #remotecodeexecution #cve2026109618 #vulnerability

3 min read

SorrelThorncroft

Oct 23

Hunting VeloCloud Orchestrator exploitation: what CVE-2026-114625 leaves in the logs

#vulnerability #sdwan #arista #velocloud

3 min read

SorrelThorncroft

Oct 23

Past Precedent: Why BeyondTrust Edge Appliances Keep Returning to the Exploited List

#zoomeye #threatintelligence #beyondtrust #edgedevices

4 min read

SorrelThorncroft

Oct 23

Appwrite: 5,102 titles, 4,094 fingerprints, and 531 hosts on the default web port

#security

3 min read

SorrelThorncroft

Oct 23

Reading the 9.9: What CVSS Tells You About CVE-2026-114625, and What It Does Not

#cvss #riskscoring #vulnerabilitymanagement #arista

2 min read

SorrelThorncroft

Oct 22

You can measure a cipher suite. You cannot measure a crypto library build

#security #zoomeyearticle

3 min read

SorrelThorncroft

Oct 22

FortiAnalyzer's collection port is the internet's most crowded number

#security #attacksurfacemanagement

4 min read

SorrelThorncroft

Oct 22

Patch Operations for CVE-2026-0315: Map GlobalProtect Builds Before You Upgrade

#patchmanagement #macos #globalprotect #cve20260315

4 min read

SorrelThorncroft

Oct 22

secure-file-priv Is Not a Patch: Hardening MariaDB File Writes After CVE-2026-107818

3 min read

SorrelThorncroft

Oct 22

Threat Modelling the Insider Path in CVE-2026-0313

#vulnerability #cortexxsoar #cve20260313

3 min read

SorrelThorncroft

Oct 22

56 million PHP and 5.5 million Node.js fingerprints: why a huge base cannot tell you who is exploitable

#zoomeye #php #node #php2shell

4 min read

SorrelThorncroft

Oct 22

CVE-2026-104286: What FortiMail Adds to the Mail Gateway Exploitation Trend

#vulnerability #emailsecurity #fortinet

3 min read

SorrelThorncroft

Oct 22

Defense in depth after the OpenVPN fixes: what to keep once 2.7.8 is deployed

#openvpn #vpn #cve #vulnerabilitymanagement

2 min read

SorrelThorncroft

Oct 21

A First-Hour Playbook for a Refrigeration Controller Alert

#ics #exposuremanagement

2 min read

SorrelThorncroft

Oct 21

Management Plane Exposure and CVE-2026-102037

#security #juniper #junos #srx

2 min read

SorrelThorncroft

Oct 21

Nine Junos Builds, One Flaw: Mapping CVE-2026-33792 to Your Fleet

#assetinventory #juniper #junos #cve202633792

3 min read

SorrelThorncroft

Oct 21

27,288 vCenter and 413,891 ESXi Assets: A Virtualization Management Baseline

#zoomeye #virtualization #exposure

3 min read

SorrelThorncroft

Oct 21

61,676 Bug Bounty Assets and 54 New Assets: Reading Coverage Flags Instead of Inventories

#zoomeye #measurement #governance

3 min read

SorrelThorncroft

Oct 21

284 Million Server Headers Against 313 Million Fingerprints: Two Ways to Count the Same Web Server

#zoomeye #measurement #webinfrastructure

3 min read

SorrelThorncroft

Oct 20

An External Verification Checklist for App-Layer RCE in a File-Sync Stack

#checklist #zoomeye #incidentresponse #cve2026110447

3 min read

SorrelThorncroft

Oct 20

Proving You Patched: Evidence and Audit Trail for CVE-2026-39919

#vulnerability #ghostscript #memorysafety

4 min read

SorrelThorncroft

Oct 20

What an IIS Compromise Would Look Like After CVE-2026-70024

#cybersecurity #infosec #microsoft #security

3 min read

SorrelThorncroft

Oct 20

CVE-2026-104286: FortiMail Path Traversal Under Active Exploitation

#vulnerability #fortinet #fortimail #cve2026104286

4 min read

SorrelThorncroft

Oct 20

Apache mod_vhost_alias Overflow CVE-2026-63292: Exposure, Exploit Conditions and Patching Priorities

#apache #httpd #vulnerability #modvhostalias

2 min read

SorrelThorncroft

Oct 19

N-able N-central CVE-2026-86218: A Pre-Authentication RCE in the Console Managed Service Providers Live In

#nable #ncentral #rmm #preauthrce

3 min read

SorrelThorncroft

Oct 19

Hunting for SQL Injection Abuse in MOVEit Transfer Before the Patch Lands

#vulnerability #moveittransfer #cve202689076

2 min read

SorrelThorncroft

Oct 19

Detecting Abuse of the SPL2 Module Catalog: CVE-2026-76270

#splunk #cve202676270 #sqlinjection #cwe89

2 min read

SorrelThorncroft

Oct 19

Prompt injection is a trust-boundary bug in the retrieval pipeline

#promptinjection #llm #rag #agents

3 min read

SorrelThorncroft

Oct 19

The Patch Window Is Collapsing: What the VMware vCenter Exploitation Timeline Shows

#cybersecurity #virtualization #ransomware #vulnerabilitymanagement

3 min read

SorrelThorncroft

Oct 15

Lab setup tips for practicing network defense at home

#cybersecurity #infrastructure #networking #security

1 min read

DEV Community

SorrelThorncroft

Badges

Writing Debut

ProFTPD mod_copy is eleven years old and back on the exploited list

Want to connect with SorrelThorncroft?

authentik: 10,425 titles, 16 fingerprints, and an identity provider that hides behind its own login page

Patching CVE-2026-109618 across a fleet: where PHP actually hides in your inventory

Hunting VeloCloud Orchestrator exploitation: what CVE-2026-114625 leaves in the logs

Past Precedent: Why BeyondTrust Edge Appliances Keep Returning to the Exploited List

Appwrite: 5,102 titles, 4,094 fingerprints, and 531 hosts on the default web port

Reading the 9.9: What CVSS Tells You About CVE-2026-114625, and What It Does Not

You can measure a cipher suite. You cannot measure a crypto library build

FortiAnalyzer's collection port is the internet's most crowded number

Patch Operations for CVE-2026-0315: Map GlobalProtect Builds Before You Upgrade

secure-file-priv Is Not a Patch: Hardening MariaDB File Writes After CVE-2026-107818

Threat Modelling the Insider Path in CVE-2026-0313

56 million PHP and 5.5 million Node.js fingerprints: why a huge base cannot tell you who is exploitable

CVE-2026-104286: What FortiMail Adds to the Mail Gateway Exploitation Trend

Defense in depth after the OpenVPN fixes: what to keep once 2.7.8 is deployed

A First-Hour Playbook for a Refrigeration Controller Alert

Management Plane Exposure and CVE-2026-102037

Nine Junos Builds, One Flaw: Mapping CVE-2026-33792 to Your Fleet

27,288 vCenter and 413,891 ESXi Assets: A Virtualization Management Baseline

61,676 Bug Bounty Assets and 54 New Assets: Reading Coverage Flags Instead of Inventories

284 Million Server Headers Against 313 Million Fingerprints: Two Ways to Count the Same Web Server

An External Verification Checklist for App-Layer RCE in a File-Sync Stack

Proving You Patched: Evidence and Audit Trail for CVE-2026-39919

What an IIS Compromise Would Look Like After CVE-2026-70024

CVE-2026-104286: FortiMail Path Traversal Under Active Exploitation

Apache mod_vhost_alias Overflow CVE-2026-63292: Exposure, Exploit Conditions and Patching Priorities

N-able N-central CVE-2026-86218: A Pre-Authentication RCE in the Console Managed Service Providers Live In

Hunting for SQL Injection Abuse in MOVEit Transfer Before the Patch Lands

Detecting Abuse of the SPL2 Module Catalog: CVE-2026-76270

Prompt injection is a trust-boundary bug in the retrieval pipeline

The Patch Window Is Collapsing: What the VMware vCenter Exploitation Timeline Shows

Lab setup tips for practicing network defense at home