Cloud IAM vs Network Security: Why Identity Has Become the New Perimeter
Network segmentation still matters, but in a cloud environment, the thing standing between an attacker and your data is increasingly a permission …
All articles
Every FirewallSync article, newest first.
CycloneDX VEX: analysis.state and justification to OpenVEX
CycloneDX VEX uses six analysis states and nine justifications; OpenVEX and CSAF use four statuses and five justifications. Here is a field-by-field …
CVE ADP Containers: CISA-ADP, CVE Program and Supplier ADPs
A CVE record has one CNA container and possibly several ADP containers. Here is what CISA-ADP, the CVE Program Container and supplier ADPs such as …
GitHub Actions OIDC: Stop Storing Cloud Credentials in CI/CD
A static cloud credential stored as a CI secret is valid until someone notices it's wrong. An OIDC-issued credential is valid for one workflow run and …
CVE Affected Versions: lessThan, defaultStatus, versionType
The affected block in a CVE record is a small algorithm, not a list. Here is how version, lessThan, lessThanOrEqual, changes, versionType and …
Vulnerability Prioritization Workflow: CVE Record to Ticket
A six-step patch-decision flow that takes a scanner finding from CVE record to ticket: check the record state, confirm you are affected, apply …
How to Secure GitHub Actions: Permissions, Secrets, and OIDC
A GitHub Actions workflow often runs with more access than the task actually requires, simply because the defaults are permissive and nobody scoped …
Escape User Input in Regex and SQL LIKE: Tested Fixes
A search box that drops user text into new RegExp() or a LIKE pattern is a small injection bug: a dot matches anything, .* matches everything, and a % …
VMware ESX CVE-2026-41709: Patch the Logging Gap Now
CISA added CVE-2026-41709, a 2.7-rated VMware ESX insufficient-logging flaw, to the KEV catalog on 28 October 2026, three months after Broadcom fixed …
Dependency Confusion: How Package Managers Can Become an Attack Path
Dependency confusion doesn't exploit a vulnerability in any package. It exploits a resolution assumption most package managers share, and it was …
Ivanti CVE-2026-111357 and CVE-2026-118527: What to Do
CISA added two more Ivanti Connect Secure flaws to KEV on 30 October: CVE-2026-111357, a privilege escalation to root, and CVE-2026-118527, a …
User-Supplied Regex: How to Run It Without ReDoS
Search filters, alert rules, routing configs and log tools all end up accepting regular expressions from users. In a backtracking engine that is a …