VeloCloud Orchestrator CVE-2026-114625: Patch and Hunt
CVE-2026-114625 is a SQL injection in on-premises Arista VeloCloud Orchestrator that lets any authenticated user, down to the Enterprise Read Only …
All articles
Every FirewallSync article, newest first.
Kubernetes Service Account Tokens: Retire Legacy Secrets
Kubernetes Pods get short-lived, Pod-bound service account tokens from the TokenRequest API, but Secret-based tokens still never expire and stay valid …
Collabora CODE CVE-2026-110447: Patch Nextcloud, Then Hunt
CVE-2026-110447 is an unauthenticated OS command injection in proxy.php of the Collabora Online Built-in CODE Server app for Nextcloud …
Kubernetes Secrets Encryption at Rest: What It Protects
Kubernetes stores Secrets unencrypted in etcd unless you configure an EncryptionConfiguration. Turning it on protects etcd data, but not against …
Atlassian CVE-2026-21589 File Read: Patch and Hunt
CVE-2026-21589 lets an unauthenticated attacker read files inside the web root of eight Atlassian Data Center products, including Jira, Confluence and …
LLM Output Handling: Treat Model Output as Untrusted Input
OWASP's LLM05:2025 covers what happens when an application passes model output to a browser, database, shell or file path without validation. Because …
Mass Assignment: How to Stop Clients Setting role=admin
Mass assignment happens when a framework binds every field in a request onto an object, so a client can set fields like role, plan or owner that the …
Kubernetes RBAC Audit: 11 Permissions That Escalate Access
Some Kubernetes RBAC permissions look harmless but let the holder become someone more powerful: list on Secrets, create on Pods, get on nodes/proxy, …
Kubernetes NetworkPolicy Default Deny: A Safe Rollout
Kubernetes allows all pod traffic until a NetworkPolicy selects a pod. A default-deny policy flips that, but it also blocks DNS, needs allow rules on …
BeyondTrust CVE-2026-102764: Patch, Then Hunt for SAWFLY
A BeyondTrust Remote Support authentication bypass was exploited as a zero-day from late August 2026. SaaS instances are patched; self-hosted …
Plex Media Server CVE-2026-96656 Chain: Patch and Hunt
Four Plex Media Server flaws fixed in 1.43.3.10861 are now in CISA's KEV catalog, and Plex says the chain is being widely exploited after a public …
Webhook Security: Signatures, Replay Protection, Idempotency
A webhook receiver is a public URL that triggers real actions. Securing it takes three separate controls: HMAC signature verification against the raw …