StarkMan - DEV Community

StarkMan

Oct 23

SSRF on a media server: the cloud instance case

#vulnerability #cve202696655 #plex #ssrf

3 min read

StarkMan

Oct 23

Ninety-four minutes: how a GitHub release page became a credential thief

#security #cybersecurityarticle

4 min read

StarkMan

Oct 23

Strapi's admin filter leaked password hashes, and the fix is a query discipline problem

#security

1

3 min read

StarkMan

Oct 23

Open WebUI: 92,252 fingerprints, 92,051 titles, and 7,087 hosts that kept the default port

#security

4 min read

StarkMan

Oct 23

From Edge Appliance to Downstream Sessions: Mapping BeyondTrust Jump Item Exposure

#zoomeye #lateralmovement #beyondtrust #attacksurface

3 min read

StarkMan

Oct 23

VeloCloud Orchestrator CVE-2026-114625: role design, host impact and the limits of the advisory

#vulnerability #sdwan #arista #velocloud

3 min read

StarkMan

Oct 23

Memory limits and attack windows: a defender's reading of CVE-2026-109618

#php #remotecodeexecution #cve2026109618 #vulnerability

3 min read

StarkMan

Oct 23

Five NGINX CVEs are conditional. Measure the conditions, not just the version

#security #zoomeyearticle

4 min read

StarkMan

Oct 22

How Exposed Is VeloCloud Orchestrator? Reading ZoomEye Evidence Honestly

#zoomeye #exposureanalysis #attacksurface #velocloud

2 min read

StarkMan

Oct 22

Shopware: 2,667 title matches, 1,094 on 443 and 80 certificate hits

#zoomeye #ecommerce #administration

3 min read

StarkMan

Oct 22

408,609 Proxmox Fingerprints and 6 Hosts on 8006: When a Query Result Describes the Scanner

#zoomeye #proxmox #hypervisor #methodology

3 min read

StarkMan

Oct 22

MariaDB's FILE Privilege Is a Filesystem Primitive: CVE-2026-107814 and CVE-2026-107818

#cybersecurity #database #infosec #security

3 min read

StarkMan

Oct 22

CVE-2026-0313 and the Blast Radius of a Content Pack: Rethinking XSOAR Trust Boundaries

#vulnerability #cortexxsoar #cve20260313

3 min read

StarkMan

Oct 22

Reading the Record: What CERTFR-2026-AVI-1326 Says About CVE-2026-0315 and What It Leaves Out

#advisoryanalysis #riskcommunication #cve20260315 #certfr

3 min read

StarkMan

Oct 22

PAN-OS CVE-2026-0321 and the cost of a mitigation that needs decryption

#panos #cve20260321 #ssldecryption #riskmanagement

3 min read

StarkMan

Oct 22

CVE-2026-110447: Why Disabling the Nextcloud Collabora App Is Not a Fix

#vulnerability #collaboration #nextcloud

3 min read

StarkMan

Oct 21

31.3 Million SSH Services and 16.5 Million RDP Endpoints: Building a Remote-Access Inventory That Survives an Incident

#zoomeye #remoteaccess #inventory

3 min read

StarkMan

Oct 21

3.2 Million Redis and 1.9 Million MongoDB Services: The Steady Background of Exposed Data Stores

#exposure #datasecurity #configuration

3 min read

StarkMan

Oct 21

OpenVPN 2.7.8 release notes for defenders: what changed and what to re-test

#openvpn #vpn #cve #vulnerabilitymanagement

2 min read

StarkMan

Oct 21

No Workaround Published: Planning Around CVE-2026-33792 When You Cannot Patch This Week

#patchmanagement #juniper #srx #cve202633792

3 min read

StarkMan

Oct 21

What Network Monitoring Can and Cannot Show About CVE-2026-102037

#security #juniper #junos #srx

2 min read

StarkMan

Oct 21

How an Attack Reaches a Fridge Without Touching the Internet

#ics #exposuremanagement

2 min read

StarkMan

Oct 21

Jenkins at 3 and Kubernetes at 1: When a Small Count Means a Missing Signature

#zoomeye #measurement #devsecops

3 min read

StarkMan

Oct 20

Hardening baselines that reduce CVE-2026-96951 exposure without waiting for the patch

#vulnerability #windows #cve202696951

3 min read

StarkMan

Oct 20

CVE-2026-70024 for the Defender: Detection, Triage and Response on IIS

#cybersecurity #infosec #microsoft #security

3 min read

StarkMan

Oct 20

Apache Solr exposure: 810,266 fingerprint matches against 73,029 title matches

#search #solr #exposuremanagement

2 min read

StarkMan

Oct 20

Building a Repeatable Public-Sector Exposure Baseline

#security #zoomeye #exposuremanagement #ddos

3 min read

StarkMan

Oct 19

Local Administrator Password Management: Why LAPS Alone Is Not Tier Separation

#activedirectory #privilegedaccess #laps

3 min read

StarkMan

Oct 19

Hunting in the mail path: five hypotheses for CVE-2026-76519 exposure

#cisco #vulnerability #emailsecurity #cve202676519

3 min read

StarkMan

Oct 19

Crypto Agility Starts With an Inventory, Not a Library

#postquantum #cryptography #inventory

1

2 min read

StarkMan

Oct 19

Preparing the evidence trail for a Fireware OS CVE-2026-18145 incident

#watchguard #logging #cve202618145 #incidentresponse

2 min read

StarkMan

Oct 18

OpenCart Storefronts: 19,439 Application Matches Against 2,911 Titles

#zoomeye #exposure

2 min read

StarkMan

Oct 18

Four Critical NX-OS CVEs at Once: How to Order the Work

#cisco #nxos #cisconexus #networksecurity

2 min read

StarkMan

Oct 18

Two Command Execution Paths, Two Different Problems: Comparing CVE-2026-102369 and CVE-2026-102294

#tplink #vulnerability #securityadvisory

3 min read

StarkMan

Oct 18

DPoP makes a token sender-constrained, which changes what a stolen token is worth

#oauth #tokensecurity #dpop #identity

3 min read

StarkMan

Oct 18

Golden ticket detection: the forged TGT that never touches the krbtgt password

#authentication #cybersecurity #infosec #security

3 min read

StarkMan

Oct 18

Assessing Business Risk from CVE-2026-89071 in Regulated File Transfers

#cve202689071 #moveittransfer #ldapinjection #vulnerabilitymanagement

2 min read

StarkMan

Oct 17

From Query Access to Root of the Database: Inside the MarkLogic Privilege Escalation Chain

#security #vulnerability #marklogic #cve202685947

2 min read

StarkMan

Oct 17

CVE-2026-81963: A Link Following Flaw in the Windows Update Stack Reaches SYSTEM

#security #vulnerability #exploitedinthewild

3 min read

StarkMan

Oct 17

CVE-2026-10520: Command Injection in Ivanti Sentry and the Edge Appliance Pattern

#edgesecurity #commandinjection #ivanti #patchmanagement

3 min read

StarkMan

Oct 17

phpIPAM: 4,238 title matches for the address register that maps a network

#infosec #networking #php #security

2 min read

StarkMan

Oct 17

CVE-2025-64393: The Mount Service, the Backup Viewer Role and a 9.4 Score

#vulnerability #veeam #backup #cve202564393

2 min read

StarkMan

Oct 17

CVE-2026-84869: a ScreenConnect client bypass and the spread that followed it

#vulnerability #rmm #remoteaccess #cisakev

2 min read

StarkMan

Oct 16

Feature policy bypass through URL-based expressions on NetScaler (CVE-2026-88774)

#security #vulnerability #citrix #netscaler

3 min read

StarkMan

Oct 16

Misskey at 3,354 fingerprint matches and 717 title matches: reading a fediverse instance count

#zoomeye #measurement #fediverse

2 min read

StarkMan

Oct 16

OpenShift: 5,436 title matches and the console that is often left reachable

#zoomeye #kubernetes #internetmeasurement #exposure

3 min read

StarkMan

Oct 16

Rate Limiting Without the Guessing: Engineering API Abuse Controls That Hold

#cybersecurity #api #rate #limiting

3 min read

StarkMan

Oct 16

Management Interface Exposure: The Real Risk Behind CVE-2026-0322

#security #vulnerability #panos #cve20260322

3 min read

StarkMan

Oct 15

Mapping Self-Hosted LLM API Gateways: What the CISA Distillation Advisory Means for Asset Owners

#security #zoomeye #ai #threatintelligence

2 min read

StarkMan

Oct 15

Shared Responsibility in Argo CD: Who Owns Each Part of CVE-2026-77459 and Its Siblings

#argocd #cve202677459 #kubernetes #gitops

2 min read

StarkMan

Oct 15

Kibana at 161,686 observed hosts: exposure of the interface that can read everything underneath it

#exposure #observability #attacksurface

3 min read

StarkMan

Oct 15

API Authentication Failures: Checks to Run Before You Blame the Rate Limiter

#apisecurity #authorization #owasp #ratelimiting

2 min read

StarkMan

Oct 14

The Sandbox That Was Not One: CVE-2026-53710 in IBM mcp-context-forge

#mcp #sandboxescape #cve202653710 #ibm

2 min read

StarkMan

Oct 14

Memcached at Internet Scale: 1,441,421 Fingerprint Matches Against 1,129,100 on Port 11211

#zoomeye #exposuremeasurement #memcached #cachesecurity

3 min read

StarkMan

Oct 13

CVE-2026-87902 Patch Matrix: Which WordPress Branches Received the Backport

#security #wordpress #vulnerability #rce

2

3 min read

StarkMan

Oct 13

Craft CMS Before 5.10.12: How a String-Typed Field Layout Reached Object Instantiation

#security #cms #php #codeexecution

1

3 min read

StarkMan

Oct 13

Writable core_pattern Is a Host Takeover: Why Container Isolation Fails at /proc/sys/kernel/core_pattern

#containers #linux #privilegeescalation

3 min read

StarkMan

Oct 13

Static analysis of infrastructure code finds what the plan already shows

#iac #cloudsecurity #devsecops

2 min read

StarkMan

Oct 13

Three Industrial Ports, Three Very Different Numbers: Reading 102, 502 and 44818 Together

#zoomeye #otsecurity #industrialcontrol #exposuremeasurement

4 min read

StarkMan

Oct 13

177 Hosts on Port 2375: Why a Small Exposure Number Can Still Be the Most Important One

#zoomeye #docker #attacksurface #containersecurity

3 min read

One Year Club

1 Week Community Wellness Streak

Writing Debut

Want to connect with StarkMan?