Blog
Everything between the weekly digests.
Commentary, field notes, compliance framing, and the analysis we couldn't fit into a morning email. One feed across every desk, ordered newest first.
-
Analysis · Jun 18, 2026 · Colten Anderson
Two Struts CVEs, one incomplete fix, and the enterprise Java visibility problem
CVE-2023-50164 and CVE-2024-53677 hit the same file upload component in Apache Struts, a year apart. The second arrived because the fix for the first didn't go far enough. The real exposure is organizations that don't know where Struts lives in their stack.
#Apache#Java#CVE-2023-50164#CVE-2024-53677#file-upload#RCE#KEV#software-composition -
Analysis · Jun 18, 2026 · Colten Anderson
Patching Ivanti Sentry Closes the Door. It Doesn't Evict the Guest.
Shadowserver found backdoored Ivanti Sentry instances within 48 hours of the PoC and said the rest are most likely compromised. The patch is step one, not the answer.
#ivanti#cve-2026-10520#cve-2026-10523#mobile-security#patch-management#exploited-in-wild -
Analysis · Jun 17, 2026 · Colten Anderson
regreSSHion proved 'hard to exploit' is not a patch window
CVE-2024-6387 got filed under 'low priority' because it's slow on 64-bit. The CVSS score measured exploit difficulty, not what a root RCE in sshd actually puts at risk.
#openssh#linux#cve-2024-6387#rce#patch-management -
Analysis · Jun 17, 2026 · Colten Anderson
Barracuda's ESG patch worked, and you still had to throw the box in the dumpster
The May 2023 patch fixed the bug and changed nothing for compromised customers. The right move was to physically replace the appliance, and that gap is the lesson.
#barracuda#exploited-in-wild#vendor-accountability -
Analysis · Jun 17, 2026 · Colten Anderson
The Cisco IOS XE reboot that wasn't remediation
Patching CVE-2023-20198 and rebooting the box clears the web shell but leaves the rogue admin account behind. If you ran one IOS XE web UI on the public internet in late 2023, you have an account audit to do before you close the ticket.
#cisco#ios-xe#cisa-kev -
Analysis · Jun 16, 2026 · Colten Anderson
Sophos has seven CISA KEV entries. Five hit the same management interface.
The User Portal and Webadmin surface runs through SQL injection, buffer overflow, authentication bypass, and code injection across five years. Chinese state actors exploited several of them as zero-days, and the exploitation often started before Sophos knew about the bugs.
#sophos#cisa-kev#firewall#chinese-apt#perimeter-security -
Analysis · Jun 16, 2026 · Colten Anderson
Juniper Junos OS has six KEV entries and two separate attack surfaces
Five CVSS 5.3 bugs in J-Web that chain to unauthenticated RCE, and a kernel isolation flaw exploited by a China-nexus actor to root MX routers. The scoring gap on the first cluster is the operational lesson.
#juniper#junos-os#j-web#cve-2023-36844#cve-2025-21590#cisa-kev#unc3886#network-infrastructure -
Analysis · Jun 16, 2026 · Colten Anderson
A model was pulled for being too good at finding bugs
Anthropic shipped Claude Fable 5 and Mythos 5, then a federal directive killed both four days later. In May we forecast the patch window had gone negative; this is the first time a regulator reached for a kill switch to agree.
#ai-security#vulnerability-management#patch-prioritization -
Analysis · Jun 8, 2026 · Colten Anderson
A crash got a federal patch deadline. Here's why that's the right call
CVE-2026-28318 is a 7.5 denial-of-service bug in SolarWinds Serv-U, the kind that usually waits. CISA listed it on KEV two days after the fix shipped. The prioritization logic behind that is the story.
#vulnerability-management#solarwinds#cisa-kev -
Field Note · Jun 5, 2026 · Colten Anderson
Three June 30 Microsoft 365 retirements that fail silently
A printer stops scanning to email, a conference-room keyboard's mute key dies, a town hall won't schedule. None of these will announce themselves on June 30, 2026.
#microsoft-365#exchange-online#microsoft-teams -
Field Note · Jun 5, 2026 · Colten Anderson
Promtail is end-of-life: your Loki shipper just lost its support floor
If Promtail still ships your logs to Loki, the agent reading every log file on the host has had no upstream remediation path since March 2, 2026. The migration to Alloy is mostly mechanical, except for the one file that decides whether you get duplicates or a gap.
#grafana#observability#loki -
Field Note · Jun 5, 2026 · Colten Anderson
One cookie to your storefront homepage is shell. CVE-2026-45247 has a Saturday deadline.
An unauthenticated RCE in the Mirasvit Cache Warmer extension is already being hit at scale, and CISA's federal patch deadline is essentially now. If you run Magento, you act today.
#magento#cisa-kev#deserialization#patch-management -
Analysis · Jun 5, 2026 · Colten Anderson
Two AWS bugs you'd never have heard about, and the fix was yours
AWS disclosed two SageMaker SDK flaws on its own bulletins page. They may carry a CVE ID with no CVSS, they'll never hit CISA KEV, and patching them is the customer's job.
#aws#cloud-security#vulnerability-management -
Analysis · Jun 5, 2026 · Colten Anderson
Your Azure CLI session has an MFA exemption you never asked for
Two Entra Conditional Access changes land in the same fortnight, and they're the lead evidence in a longer story: Microsoft is closing the identity opt-outs orgs have leaned on for years.
#microsoft-entra#conditional-access#identity -
Analysis · Jun 4, 2026 · Colten Anderson
The GlobalProtect bypass deadline already passed, but you might not be affected
CVE-2026-0257 is a GlobalProtect auth bypass with a KEV deadline that's come and gone. Whether it touches you comes down to a 60-second config check, not your PAN-OS version.
#palo-alto#cisa-kev#vpn#patch-management -
Analysis · Jun 3, 2026 · Colten Anderson
Three CVEs keep getting called the Nx attack, and only one of them is this one
An 18-minute window on the VS Code marketplace ended with 3,800 of GitHub's own repositories copied. The interesting part isn't the speed. It's the delivery channel nobody was watching.
#supply-chain#vs-code-extensions#nx -
Analysis · Jun 3, 2026 · Colten Anderson
Everything is critical, so nothing is critical
A third of last year's CVEs were rated High or Critical, but only a few percent ever get exploited. The severity score was never a risk score, and the queue that treats it like one is the reason confirmed-exploited bugs sit unpatched for 43 days.
#cvss#vulnerability-prioritization#cisa-kev#epss -
Analysis · Jun 3, 2026 · Colten Anderson
The patch triage meeting that ends with owners, not opinions
The short-list is built before anyone sits down. The meeting exists to put a name and a clock on each item, then end. Here's how to run it in fifteen minutes.
#patch-management#triage#ssvc#change-management#vulnerability-management -
Analysis · Jun 2, 2026 · Colten Anderson
One CERT says it's exploited, Microsoft says it isn't, and you patch anyway
A pre-auth SYSTEM RCE on every domain controller doesn't need an exploitation rumor to earn the top of your patch queue. The interesting part is why the alarm and the data disagree, and why that disagreement shouldn't change your call.
#microsoft#netlogon#active-directory#patch-tuesday#cve-2026-41089 -
Field Note · May 29, 2026 · Colten Anderson
Enforcing and proving BitLocker TPM+PIN across an Intune fleet
Requiring a startup PIN is one toggle. Landing it on already-encrypted devices and proving it took across the whole fleet is the actual work. Here's the enforce-and-verify runbook.
#bitlocker#intune#compliance -
Analysis · May 29, 2026 · Colten Anderson
Gogs has a critical RCE and no one is coming to fix it
Rapid7 found a push-button remote code execution flaw in Gogs, shipped a Metasploit module with it, and ran 72 days from report to publication with no patch and two months of maintainer silence. There is no fix. There may never be one.
#gogs#unpatched-vulnerability#self-hosted-git#migration -
Analysis · May 29, 2026 · Colten Anderson
Palo Alto's third edge zero-day in two years rhymes with the first two
CISA's federal deadline for CVE-2026-0300 landed four days before a patch existed. The deadline is not the story. The third PAN-OS portal zero-day in under two years is.
#pan-os#edge-appliances#zero-day -
Analysis · May 28, 2026 · Colten Anderson
GlassWorm's botnet is down, but the technique it proved still works
CrowdStrike, Google, and Shadowserver knocked out all four C2 channels at once. That ends the infrastructure, not the playbook. Three primitives outlive the takedown.
#supply-chain#developer-tooling#threat-intel -
Field Note · May 28, 2026 · Colten Anderson
NGINX Rift: four places apt upgrade doesn't reach
The host patch for CVE-2026-42945 shipped on day one. The container images, the App Protect WAF in front of it, the downstream forks, and the config audit it leaves behind are separate jobs.
#nginx#patch-management#containers#waf#supply-chain -
Analysis · May 28, 2026 · Colten Anderson
Ingress-nginx got archived in March. The first critical CVE arrived in May.
The Kubernetes community archived ingress-nginx seven weeks before an 18-year-old heap overflow dropped in the NGINX core it ships. The fix path is now a migration project, not a patch.
#kubernetes#nginx#open-source -
Analysis · May 28, 2026 · Colten Anderson
The print stack regresses on schedule
KB5087424 broke 32-bit printing on Windows Server 2022 hotpatch fleets. It's the latest data point in a five-year arc of print-stack regressions that track Microsoft's deliberate retirement of the legacy spooler architecture.
#windows-server-2022#print-spooler#hotpatch#patch-regression#microsoft#windows-protected-print -
Analysis · May 27, 2026 · Colten Anderson
Hotpatch was supposed to be the smoother path
KB5087424 broke 32-bit printing on Windows Server 2022, and the no-reboot delivery model that was supposed to reduce friction has no fix path that doesn't surrender the security content.
#windows-server-2022#hotpatch#print-spooler -
Analysis · May 25, 2026 · Colten Anderson
Microsoft patched a SYSTEM bug in 2020. It still works in 2026.
A pseudonymous researcher published MiniPlasma, a working PoC for CVE-2020-17103, and the only thing standing between you and a SYSTEM shell is a driver you cannot turn off.
#windows#patch-management#vulnerability-disclosure -
Analysis · May 25, 2026 · Colten Anderson
SonicWall patched CVE-2024-12802 and left the bug in place on Gen6
The firmware update closes the code path but does not rewrite the LDAP config the exploit actually uses. On Gen6, that distinction is the whole vulnerability.
#sonicwall#cisa-kev#vpn#mfa#gen6 -
Analysis · May 24, 2026 · Colten Anderson
The patch window went negative. Now what?
Mandiant's mean time-to-exploit is negative seven days. NVD gave up on enriching most of the catalog. Here's what the next 24 months of patch management actually look like with AI on both sides.
#ai-security#patch-management#forecast#vulnerability-management#regulatory -
Analysis · May 22, 2026 · Colten Anderson
Your antivirus runs as SYSTEM, and that's the whole story
Two actively-exploited Defender zero-days look like 'the AV is broken.' The pattern underneath is older and more boring: the scanner has run unsandboxed as SYSTEM for a decade, and that makes it a target, not a sentinel.
#microsoft-defender#privilege-escalation#kev -
Analysis · May 20, 2026 · Colten Anderson
Before MOVEit and GoAnywhere, Cl0p's playbook was born on a 20-year-old Accellion box
The Accellion FTA breaches of late 2020 are where Cl0p's mass-data-theft-and-extortion model started. Four CVEs in a legacy file-transfer appliance, exploited to steal data from dozens of organizations. The product was already two decades old and on its way out.
#accellion#cisa-kev#clop#file-transfer#end-of-life -
Analysis · May 20, 2026 · Colten Anderson
Your attack surface isn't just port 443
CVE-2023-46604 is a perfect-10 RCE in Apache ActiveMQ. The exploit isn't a web request; it's a single message to the broker on port 61616, a port most web-focused scanning and firewalling never considers. The broker then fetches a remote XML file and runs whatever's in it.
#apache#activemq#cisa-kev#ransomware#attack-surface -
Analysis · May 20, 2026 · Colten Anderson
Adobe ColdFusion has been getting popped the same ways for 15 years
The KEV catalog holds a long run of ColdFusion bugs: deserialization RCEs, access-control bypasses, and file uploads, from 2013 to 2024. Different CVEs, same handful of weaknesses. If you still run internet-facing ColdFusion, you're operating a perennial target.
#adobe#coldfusion#cisa-kev#deserialization#web-security -
Analysis · May 20, 2026 · Colten Anderson
Apache HTTP Server 2.4.49: a path-traversal fix that needed a second fix
CVE-2021-41773 was a path traversal in Apache httpd 2.4.49 that could leak files and, with CGI enabled, reach RCE. The 2.4.50 fix was incomplete, so CVE-2021-42013 followed days later. Two CVEs, one bug, a textbook patch-the-patch.
#apache#cisa-kev#path-traversal#web-server#patch-management -
Analysis · May 20, 2026 · Colten Anderson
Insecure deserialization isn't a Java problem. Ask Ruby's YAML.load.
CVE-2022-47986 is a pre-auth RCE in IBM Aspera Faspex from a single call to YAML.load on data an unauthenticated user controls. It's the Ruby version of the deserialization footgun, and ransomware crews used it to move onto Linux.
#ibm#aspera-faspex#cisa-kev#deserialization#ransomware -
Analysis · May 20, 2026 · Colten Anderson
BlueKeep: the wormable RDP bug Microsoft patched Windows XP for
CVE-2019-0708 was a pre-authentication, wormable RCE in Windows Remote Desktop. Microsoft was scared enough of a WannaCry repeat that it shipped patches for end-of-life XP and Server 2003. The worm never fully came, but the lesson did: RDP doesn't belong on the internet.
#microsoft#windows#cisa-kev#rdp#ransomware -
Analysis · May 20, 2026 · Colten Anderson
Apple, Chrome, Android: the zero-day stream that mostly isn't aimed at you
The catalog's Apple, Google/Chrome, Android, Samsung, and Qualcomm entries are overwhelmingly browser and mobile zero-days, many used by mercenary spyware against specific people. For most organizations the defense is one boring control: fast auto-update.
#apple#google#cisa-kev#spyware#mobile -
Analysis · May 20, 2026 · Colten Anderson
They read one file off the VPN gateway and left with your whole Active Directory
CVE-2024-24919 is filed as 'information disclosure.' On a Check Point gateway that meant unauthenticated file read, which meant password hashes, which meant ntds.dit within hours. It was a zero-day for a month before disclosure, and patching it doesn't undo the theft.
#check-point#cisa-kev#vpn#active-directory#incident-response -
Analysis · May 20, 2026 · Colten Anderson
CISA just gave the Conficker bug a 2026 deadline
Five of the seven CVEs CISA added on May 20 are 2008–2010 fossils, including MS08-067 and Operation Aurora. KEV inclusion means current exploitation, so the real signal isn't nostalgia.
#cisa-kev#legacy-systems#vulnerability-management -
Analysis · May 20, 2026 · Colten Anderson
Cisco's management and identity products keep showing up in the catalog
Smart Licensing Utility, Identity Services Engine, IOS XE, Catalyst SD-WAN Manager, Unified Communications Manager, a run of exploited Cisco bugs in 2024-2026, including a hardcoded credential and several unauthenticated RCEs. The management plane is the target.
#cisco#cisa-kev#identity#rce#management-plane -
Analysis · May 20, 2026 · Colten Anderson
The VPN bug that isn't on the gateway, it's the updater on the laptop
CVE-2020-3433 and CVE-2020-3153 are in the Cisco AnyConnect Windows client, not the VPN gateway. The weak point is the privileged helper service that auto-updates the client, which a local user can trick into running their code as SYSTEM.
#cisco#anyconnect#cisa-kev#privilege-escalation#endpoint -
Analysis · May 20, 2026 · Colten Anderson
A 2020 bug leaked VPN passwords. The orgs that survived had MFA.
CVE-2020-3259 lets an unauthenticated attacker read Cisco ASA memory, sometimes including VPN credentials in cleartext. Akira ransomware used it for initial access years after the patch. The control that turned a leaked password into a non-event was multi-factor authentication.
#cisco#cisa-kev#vpn#ransomware#mfa -
Analysis · May 20, 2026 · Colten Anderson
The unlocked side door on your Cisco VPN was the default group nobody configured
CVE-2023-20269 let attackers brute-force Cisco ASA VPN credentials and establish unauthorized sessions, both by abusing default connection profiles that ship enabled. Akira and LockBit used it for initial access. The fix is patching plus hardening the defaults you never touched.
#cisco#cisa-kev#vpn#ransomware#hardening -
Field Note · May 20, 2026 · Colten Anderson
Patching the NetScaler RCE doesn't tell you if a webshell is already on it
CVE-2023-3519 was an unauthenticated RCE on Citrix NetScaler used as a zero-day to drop webshells. Patching closes the hole; it doesn't remove an implant planted before you patched. With a black-box appliance, finding out is the hard part. Here's the IOC-hunt runbook.
#citrix#netscaler#cisa-kev#incident-response#forensics -
Analysis · May 20, 2026 · Colten Anderson
CitrixBleed: the patch closed the leak but left the stolen keys working
CVE-2023-4966 leaked post-MFA session tokens from NetScaler. Organizations that patched and stopped there got breached anyway, because a stolen token still worked after the update. The action that mattered was killing every active session, and a lot of victims skipped it.
#citrix#netscaler#cisa-kev#lockbit#incident-response -
Analysis · May 20, 2026 · Colten Anderson
Shitrix: the Citrix bug that taught everyone how fast a perimeter RCE goes from PoC to pandemic
CVE-2019-19781, 'Shitrix,' was a path-traversal RCE in Citrix NetScaler. After disclosure with no patch, a public exploit dropped and mass exploitation followed within days. It set the template for the NetScaler-as-target story that CitrixBleed later continued.
#citrix#netscaler#cisa-kev#rce#perimeter -
Analysis · May 20, 2026 · Colten Anderson
A new critical Confluence RCE stopped being news. That's the problem.
CVE-2022-26134, CVE-2023-22515, CVE-2023-22518, CVE-2023-22527: Atlassian Confluence Server and Data Center has been mass-exploited so many times that the headline repeats. If you run it on the internet, you're operating one of the most reliably-targeted boxes there is.
#atlassian#confluence#cisa-kev#rce#patch-management -
Analysis · May 20, 2026 · Colten Anderson
22,000 servers ransomed in days: the CyberPanel control-panel wipeout
Two CVSS-10 pre-auth RCEs in CyberPanel let the PSAUX ransomware crew encrypt roughly 22,000 internet-exposed servers in late October 2024. Hosting control panels run as root and face the internet by design, which is exactly why one bug becomes a fleet-wide event.
#cyberpanel#cisa-kev#ransomware#hosting-panel#web-security -
Analysis · May 20, 2026 · Colten Anderson
When the build tool, the GitHub Action, and sudo are the vulnerability
tj-actions, a poisoned GitHub Action; Sudo's chroot bug; 7-Zip's Mark-of-the-Web bypass; Git, FreeType, Erlang/OTP, PHPMailer, Vite, jQuery. The developer-tooling and dependency entries are the supply chain itself getting exploited, the layer beneath the apps you ship.
#cisa-kev#supply-chain#developer-tools#dependencies#ci-cd -
Analysis · May 20, 2026 · Colten Anderson
The dev stack is production: RCEs in CI servers, AI tools, and CMSes you exposed
Jenkins, GitLab, Tomcat, OFBiz, Craft CMS, plus a new wave of AI/dev tools, Langflow, n8n, Marimo, Trivy, Livewire. The DevTools and supply-chain entries share a blind spot: the development and automation stack is internet-facing production infrastructure, and it gets exploited like it.
#cisa-kev#devtools#supply-chain#ci-cd#rce -
Analysis · May 20, 2026 · Colten Anderson
An uploaded filename is attacker input. dotCMS forgot, and got a webshell.
CVE-2022-26352 is a directory traversal in dotCMS's upload API: the filename in a multipart request wasn't sanitized, so '../' sequences let an attacker write a JSP webshell to a web-reachable directory. With anonymous content creation on, that's unauthenticated RCE.
#dotcms#cisa-kev#file-upload#web-security#cms -
Analysis · May 20, 2026 · Colten Anderson
Drupalgeddon: when a data structure is allowed to name a function to call
Drupal's Form API lets a renderable array carry a callback, that's a feature. Drupalgeddon (CVE-2018-7602) let an attacker put their own callback in, and Drupal called it: exec, passthru, system. Powerful framework metaprogramming plus untrusted input equals RCE.
#drupal#cisa-kev#rce#web-security#cms -
Analysis · May 20, 2026 · Colten Anderson
The same handful of mechanisms account for most of the catalog
After the marquee bugs, Tier 1's remaining entries, DotNetNuke, ForgeRock, BQE, Sophos, Tomcat, Citrix ShareFile, SAP, Quest, Atlassian Crowd, Exim, Cisco ASA, Office, don't introduce new lessons. They confirm the few recurring mechanisms behind nearly every exploited vulnerability.
#cisa-kev#rce#deserialization#web-security#patch-management -
Analysis · May 20, 2026 · Colten Anderson
The year on-premise Exchange became the most-attacked software on earth
ProxyLogon and ProxyShell turned 2021 into open season on Exchange Server. Two unauthenticated RCE chains, tens of thousands of web-shelled servers, an FBI operation to clean them up. If you still run Exchange on-prem, you're operating a permanent top-tier target.
#microsoft#exchange#cisa-kev#proxylogon#proxyshell -
Analysis · May 20, 2026 · Colten Anderson
A mitigation blocks a path. OWASSRF found another door.
After ProxyNotShell, Microsoft told Exchange admins to apply URL-rewrite mitigations while the patch was finished. OWASSRF (CVE-2022-41080) walked around them by knocking on OWA instead of Autodiscover, and Play ransomware walked in. Mitigations aren't fixes.
#microsoft#exchange#cisa-kev#play-ransomware#mitigation -
Analysis · May 20, 2026 · Colten Anderson
The F5 auth bypass that fit in one header: Connection: X-F5-Auth-Token
CVE-2022-1388 let unauthenticated attackers run commands as root on F5 BIG-IP by abusing hop-by-hop header handling. Naming the auth-token header in the Connection header made the proxy strip it after the auth check read it, but before the backend did.
#f5#big-ip#cisa-kev#authentication-bypass#web-security -
Field Note · May 20, 2026 · Colten Anderson
F5 CVE-2023-46747: the backend trusted a header that said 'I'm already an admin'
The Tomcat backend behind F5's config utility trusted a remote_user header as proof of authentication, assuming only the front-end could set it. HTTP-to-AJP request smuggling let attackers set it themselves, for unauthenticated root. Here's how to check, patch, and lock it down.
#f5#big-ip#cisa-kev#authentication-bypass#incident-response -
Analysis · May 20, 2026 · Colten Anderson
Content-process only is one bug short of game over
CVE-2024-9680 was a Firefox use-after-free that 'only' ran code in the sandboxed content process. RomCom paired it with a Windows sandbox escape and turned a single page visit into a backdoor. Mozilla shipped the fix in about 25 hours.
#mozilla#firefox#cisa-kev#browser-security#patch-management -
Analysis · May 20, 2026 · Colten Anderson
Everyone hardened against macros. Follina didn't use one.
CVE-2022-30190 (Follina) ran code from a Word document with no macro at all, by abusing a Windows URL protocol handler to invoke the Support Diagnostic Tool. It defeated macro-based defenses, and Microsoft had reportedly closed an earlier report as 'not a security issue.'
#microsoft#office#cisa-kev#follina#protocol-handlers -
Field Note · May 20, 2026 · Colten Anderson
FortiClient EMS CVE-2023-48788: a SQL injection that talks the database into running SYSTEM commands
When a product runs on Microsoft SQL Server, a SQL injection is rarely just a data leak. The attacker turns on xp_cmdshell from inside the injection and gets OS command execution. On FortiClient EMS that's unauthenticated, as SYSTEM. Here's how to check, patch, and detect it.
#fortinet#forticlient-ems#cisa-kev#sql-injection#incident-response -
Analysis · May 20, 2026 · Colten Anderson
Fortinet's other products take their turn: FortiWeb, FortiManager, FortiClient EMS
Beyond the long-running FortiOS auth-bypass cycle, 2025-2026 brought a wave of exploited bugs in FortiWeb, FortiManager, and FortiClient EMS, SQL injection, path traversal, auth bypass, and a format-string RCE. Same vendor, same perimeter-and-management target profile.
#fortinet#cisa-kev#fortiweb#perimeter#rce -
Analysis · May 20, 2026 · Colten Anderson
The 'test connection' button that mails your stored credentials to an attacker
CVE-2018-13374 lets an attacker recover the LDAP bind credentials stored in a FortiGate by pointing its LDAP connectivity test at a rogue server. It's a small bug with a broad lesson: 'test connection' features that transmit stored secrets are a credential-disclosure pattern.
#fortinet#cisa-kev#credentials#active-directory#api-security -
Field Note · May 20, 2026 · Colten Anderson
Patching the Fortinet auth bypass doesn't remove the admin account the attacker added
CVE-2022-40684 let unauthenticated attackers act as administrator on FortiOS, FortiProxy, and FortiSwitchManager by spoofing trusted headers. The exploit's payoff was planting an SSH key or super-admin account, so patching after exposure leaves the back door in place.
#fortinet#cisa-kev#authentication-bypass#incident-response#firewall -
Analysis · May 20, 2026 · Colten Anderson
The ransomware that brought a signed driver to switch off the rule against unsigned drivers
In 2020, RobbinHood became the first ransomware seen shipping a legitimately-signed GIGABYTE driver, exploiting it to disable Windows driver-signature enforcement, then loading its own unsigned driver to kill security software from the kernel. The four GIGABYTE CVEs are why.
#gigabyte#cisa-kev#byovd#ransomware#drivers -
Analysis · May 20, 2026 · Colten Anderson
GitLab CVE-2021-22205: the upload that ran code through an image parser
CVE-2021-22205 is an unauthenticated RCE in GitLab, but the bug wasn't really in GitLab. It was in ExifTool, the metadata library GitLab used to process uploaded images. Upload a crafted file, ExifTool parses it, code runs. Image parsers are a recurring RCE vector.
#gitlab#cisa-kev#dependencies#rce#image-parsing -
Analysis · May 20, 2026 · Colten Anderson
Scattered Spider didn't need a zero-day. They brought a decade-old driver Windows still loads.
CVE-2015-2291 is a vulnerable Intel Ethernet driver. Scattered Spider loaded it to reach the kernel and patch out Defender, CrowdStrike, SentinelOne, and Palo Alto in memory. It's the classic bring-your-own-vulnerable-driver attack, and the defenses are switches you can flip today.
#microsoft#windows#cisa-kev#byovd#edr -
Analysis · May 20, 2026 · Colten Anderson
The catalog is full of cheap routers and cameras for one reason: they're botnet feedstock
Scroll the KEV catalog and you hit a wall of command-injection bugs in D-Link, TP-Link, DrayTek, ASUS, Netgear, and IP-camera firmware. They're not separate stories. They're the same story: internet-exposed consumer gear that gets conscripted into IoT botnets, and the fix is almost always the same.
#iot#cisa-kev#botnet#soho-router#end-of-life -
Analysis · May 20, 2026 · Colten Anderson
Ivanti Endpoint Manager: the management server that can be coerced into handing over credentials
CVE-2024-13159, 13160, and 13161 are path-traversal/credential-coercion flaws in Ivanti Endpoint Manager that let an attacker make the EPM server authenticate to them and relay it. It's another Ivanti product, and another privileged management server worth defending as tier-zero.
#ivanti#cisa-kev#endpoint-management#credentials#relay -
Analysis · May 20, 2026 · Colten Anderson
When a vulnerability is shaped exactly like a backdoor
CVE-2021-44529 triggers when you send Ivanti's appliance a cookie that says 'ab' followed by base64 the server decodes and runs. That's not what an accidental bug looks like. Whether it was planted or just terrible code, the lesson about dependency provenance is the same.
#ivanti#cisa-kev#supply-chain#code-injection#open-source -
Field Note · May 20, 2026 · Colten Anderson
Jenkins CVE-2024-23897: from 'limited file read' to your secret key
The KEV entry calls it 'limited read access to certain files.' On a Jenkins controller, the files include the cryptographic key that turns read into remote code execution. Here's how to check, patch, and what to rotate if you were exposed.
#jenkins#cisa-kev#ci-cd#ransomware#incident-response -
Analysis · May 20, 2026 · Colten Anderson
Compromise one MSP's RMM, ransom a thousand businesses: the Kaseya pattern
Kaseya VSA is remote-monitoring software MSPs use to manage thousands of client machines. That reach is why it keeps getting attacked, and why in 2021 REvil used it to push ransomware to roughly 1,500 downstream businesses in a single weekend.
#kaseya#cisa-kev#msp#ransomware#supply-chain -
Field Note · May 20, 2026 · Colten Anderson
Laravel CVE-2021-3129: the RCE that only fires when debug mode is on in production
CVE-2021-3129 is unauthenticated remote code execution in Laravel's Ignition error page. It only works when APP_DEBUG is true, which should never be the case in production. Here's how to confirm debug mode is off everywhere, patch, and check whether you were hit.
#laravel#php#cisa-kev#configuration#incident-response -
Analysis · May 20, 2026 · Colten Anderson
900 old bugs, one answer: patch what's supported, retire what isn't
More than half the KEV catalog is pre-2025 legacy: old Windows, IE, Office, Flash, Java, Apache, and a sea of network gear. They're still listed because they're still exploited on the systems nobody updated. The legacy tier is huge, and its remediation is short.
#cisa-kev#legacy-systems#end-of-life#patch-management#attack-surface -
Analysis · May 20, 2026 · Colten Anderson
Why a decade-old Silverlight bug is in a 2022 exploited-vulnerability list
The KEV catalog includes Microsoft Silverlight, Oracle Java, JBoss, and Outside In bugs from 2010 to 2016. They're there because the software is still running somewhere. For most of these, the fix isn't a patch, it's removing a runtime you stopped needing years ago.
#legacy-systems#cisa-kev#attack-surface#end-of-life#patch-management -
Analysis · May 20, 2026 · Colten Anderson
Still running SMBv1? The catalog has a 2017 reminder for you.
A cluster of old Windows bugs sits in the KEV catalog: an SMBv1 information-disclosure from the MS17-010 family that powered WannaCry, plus assorted legacy privilege-escalation flaws. They share one fix path: keep supported Windows patched, kill SMBv1, retire end-of-life.
#microsoft#windows#cisa-kev#smbv1#end-of-life -
Analysis · May 20, 2026 · Colten Anderson
The fix shipped in 2015. The CVE came in 2017. The deadline landed in 2024.
CVE-2017-1000253 is a Linux kernel privilege escalation that was already patched upstream two years before it got a CVE. It got a federal deadline the same year CentOS 7 died. 'Patched upstream' never meant 'patched on your box.'
#linux#cisa-kev#privilege-escalation#end-of-life#patch-management -
Analysis · May 20, 2026 · Colten Anderson
The Linux firewall bug your users can reach because you gave them a private root
CVE-2024-1086 is an nf_tables use-after-free that hands a local user root. The reason an unprivileged user can touch the kernel's packet-filtering engine at all is unprivileged user namespaces, and turning those off defuses a whole class of these bugs at once.
#linux#cisa-kev#privilege-escalation#ransomware#hardening -
Analysis · May 20, 2026 · Colten Anderson
Everyone remembers patching Log4Shell. Few built the thing that would make the next one easy.
CVE-2021-45046 is the bug that proved the first Log4Shell fix was incomplete, kicking off a patch-the-patch cascade in December 2021. The teams that 'patched Log4j' on day one had to do it again, and again. The durable lesson wasn't speed. It was knowing where the dependency lived.
#log4j#cisa-kev#dependencies#patch-management#supply-chain -
Analysis · May 20, 2026 · Colten Anderson
Turning on SSO turned on the vulnerability, and turning it back off didn't help
CVE-2022-47966 gave unauthenticated RCE across two dozen ManageEngine products, but only where SAML single sign-on was enabled. The best-practice config was the attack surface, the root cause was a years-stale bundled library, and 'was enabled' counted too.
#manageengine#cisa-kev#sso#dependencies#apt -
Analysis · May 20, 2026 · Colten Anderson
The most dangerous server in the hospital is the one nobody can name
Mirth Connect moves patient records between systems and runs with high privileges, and a lot of installs sit on the open internet. CVE-2023-43208 is an unauthenticated RCE in it, and it's a patch bypass: the first fix used a denylist, and a researcher walked around it.
#healthcare#cisa-kev#deserialization#ransomware#middleware -
Analysis · May 20, 2026 · Colten Anderson
Lorenz ransomware's way in was the phone system
In 2022, Lorenz ransomware breached corporate networks through a Mitel MiVoice Connect appliance, the VoIP system, using CVE-2022-29499 as a zero-day. Telephony and unified-comms appliances are edge servers running web code, and almost nobody treats them that way.
#mitel#cisa-kev#voip#lorenz#ransomware -
Analysis · May 20, 2026 · Colten Anderson
You can be the victim of a vulnerability in software you don't run
Most of the 90-plus million people whose data Cl0p stole through MOVEit had never heard of it, and their data leaked through payroll firms and service bureaus, not their own systems. CVE-2023-34362 is the case study in third-party data risk you can't patch your way out of.
#progress#moveit#cisa-kev#clop#supply-chain -
Analysis · May 20, 2026 · Colten Anderson
The tool that audits everything runs as SYSTEM everywhere. That cuts both ways.
CVE-2022-31199 is unauthenticated RCE as SYSTEM in Netwrix Auditor, and it hits the server and the agents on every monitored system. Truebot used it. A privileged monitoring tool with agents across your estate is a shadow administration layer, and a force multiplier when it's compromised.
#netwrix#cisa-kev#truebot#deserialization#lateral-movement -
Analysis · May 20, 2026 · Colten Anderson
noPac: any domain user to Domain Admin, no exploit code required
CVE-2021-42278 and CVE-2021-42287 chain into 'noPac,' which takes a standard domain user to Domain Admin in about one command. There's no memory corruption, just abused Active Directory name handling, riding on a default that lets ordinary users create computer accounts.
#microsoft#active-directory#cisa-kev#privilege-escalation#kerberos -
Analysis · May 20, 2026 · Colten Anderson
Known exploited, no patch: what to do in the weeks before a fix exists
When Microsoft disclosed CVE-2023-36884, it was already being used by a Russian group against governments, and there was no patch for weeks. Only mitigations. That scenario is more common than a patch-centric process assumes, and mitigations are the plan, not a consolation prize.
#microsoft#office#cisa-kev#romcom#mitigation -
Analysis · May 20, 2026 · Colten Anderson
OMIGOD: an unauth root RCE in an agent you didn't know Azure installed
CVE-2021-38647 is an unauthenticated remote code execution as root in the OMI agent. Most victims didn't know they were running OMI, Azure silently deployed it on Linux VMs when you enabled common services. Invisible agents are invisible attack surface.
#microsoft#azure#cisa-kev#cloud#agents -
Analysis · May 20, 2026 · Colten Anderson
Your ERP is on the internet, and it's the system that cuts the checks
Security programs treat ERP as 'internal.' Oracle E-Business Suite exposes web modules to the internet by design, and CVE-2022-21587 turned one into unauthenticated code execution on the system that runs payroll, purchase orders, and the general ledger.
#oracle#cisa-kev#erp#attack-surface#ransomware -
Analysis · May 20, 2026 · Colten Anderson
A CVSS 10 that hinged on one unchecked box: 'Validate Identity Provider Certificate'
CVE-2020-2021 let attackers bypass authentication on Palo Alto firewalls and VPNs using SAML, but only when one option was disabled: 'Validate Identity Provider Certificate.' A perfect-10 bug whose presence depended on a checkbox.
#palo-alto#cisa-kev#saml#authentication-bypass#configuration -
Analysis · May 20, 2026 · Colten Anderson
Palo Alto GlobalProtect CVE-2019-1579: another VPN gateway, another pre-auth RCE
CVE-2019-1579 was a pre-authentication remote code execution in Palo Alto's GlobalProtect SSL-VPN. It's one more entry in the longest-running story in this catalog: the SSL-VPN gateway as a perennial, pre-auth-RCE-prone perimeter target.
#palo-alto#cisa-kev#vpn#rce#perimeter -
Analysis · May 20, 2026 · Colten Anderson
PetitPotam: make a domain controller authenticate to you, relay it, own the domain
CVE-2021-36942 lets an attacker coerce a Windows machine, including a domain controller, into authenticating to them. Relay that to Active Directory Certificate Services and you can mint a certificate as the DC. It's an Active Directory configuration problem as much as a patch.
#microsoft#active-directory#cisa-kev#ntlm-relay#adcs -
Analysis · May 20, 2026 · Colten Anderson
A soft hyphen reopened a bug PHP closed in 2012
CVE-2024-4577 is a patch bypass of a 12-year-old PHP-CGI flaw. The 2012 fix sanitized the input. Windows then helpfully rewrote a soft hyphen back into a real one, after the check, and handed the attacker their command-line argument anyway.
#php#cisa-kev#ransomware#web-security#patch-management -
Analysis · May 20, 2026 · Colten Anderson
PHP-FPM CVE-2019-11043: an RCE that depended on a copy-pasted nginx config
CVE-2019-11043 is a remote code execution bug in PHP-FPM, but it only fires on a specific nginx configuration, one that circulated widely in tutorials and got copy-pasted into production everywhere. The bug is in the code; the exposure came from a config snippet.
#php#cisa-kev#nginx#rce#configuration -
Analysis · May 20, 2026 · Colten Anderson
DeadBolt skipped the network intrusion and just encrypted the NAS directly
Most ransomware has to break in, escalate, and spread before it encrypts anything. DeadBolt found internet-exposed QNAP NAS devices, exploited a Photo Station bug, and encrypted the files in place. On a NAS, the device is the data, and that changes the whole attack.
#qnap#cisa-kev#nas#ransomware#deadbolt -
Analysis · May 20, 2026 · Colten Anderson
Why ransomware crews love a backup server twice over
CVE-2022-36537 is a ZK Framework bug that handed attackers ConnectWise R1Soft backup servers. A backup server is the perfect ransomware target for two reasons at once: it can push code to everything it protects, and destroying it removes the one thing that lets a victim refuse to pay.
#connectwise#cisa-kev#backup#ransomware#supply-chain -
Analysis · May 20, 2026 · Colten Anderson
2017's other wormable file-share RCE, the one nobody remembers, is still on your NAS
Everyone remembers EternalBlue tearing through Windows SMB in 2017. The same year, Samba shipped a fix for SambaCry: upload a library to a writable share, trigger it, get root. It lives on in the NAS and IoT boxes that embed Samba and never update.
#samba#cisa-kev#nas#file-sharing#end-of-life -
Analysis · May 20, 2026 · Colten Anderson
The other half of the ScreenConnect chain just got a 2026 deadline
CVE-2024-1709 got the CVSS 10 and the headlines in February 2024. The path-traversal half that actually lands code execution, CVE-2024-1708, only got its own KEV deadline on April 28, 2026. Two years late, same chain.
#connectwise#cisa-kev#ransomware#remote-access -
Analysis · May 20, 2026 · Colten Anderson
The attacker installed a second antivirus to crash your first one
CVE-2024-38094 is a 7.2. It requires authentication. Most teams filed it below the criticals. It was still the entry point for a two-week, full-domain compromise, and the cleanup tactic was installing rogue antivirus to make the real EDR fall over.
#microsoft#sharepoint#cisa-kev#ransomware#incident-response -
Analysis · May 20, 2026 · Colten Anderson
A bug that won $100k at Pwn2Own in March was encrypting SharePoint by winter
The CVE-2023-29357 + CVE-2023-24955 chain gives unauthenticated RCE on SharePoint. It was demoed at Pwn2Own in March 2023, patched mid-year, had a public PoC by late 2023, and hit the KEV list in early 2024. That timeline is something you can plan around.
#microsoft#sharepoint#cisa-kev#pwn2own#patch-management -
Analysis · May 20, 2026 · Colten Anderson
Sitecore CVE-2021-42237: another .NET deserialization RCE in a CMS you forgot was internet-facing
CVE-2021-42237 is an insecure-deserialization RCE in Sitecore XP. It's the same .NET deserialization footgun that keeps showing up in enterprise web apps, on a CMS that often sits forgotten but internet-facing.
#sitecore#cisa-kev#deserialization#cms#web-security -
Analysis · May 20, 2026 · Colten Anderson
SolarWinds Serv-U: a state actor's zero-day in yet another file-transfer product
CVE-2021-35211 was a zero-day RCE in SolarWinds Serv-U, exploited by a China-nexus actor weeks after the SUNBURST headlines faded. It's another managed-file-transfer product turned into a foothold, the category attackers keep returning to.
#solarwinds#cisa-kev#file-transfer#apt#rce -
Analysis · May 20, 2026 · Colten Anderson
2021 was open season on SonicWall's appliances, remote access and email alike
In 2021, SonicWall's SMA/SRA remote-access appliances and its Email Security product were both hit by zero-day exploitation, by ransomware crews and APTs. Seven of those CVEs are in the catalog, several used before patches existed.
#sonicwall#cisa-kev#vpn#email-security#ransomware -
Analysis · May 20, 2026 · Colten Anderson
Akira's favorite front door is a SonicWall SSL-VPN, and it's fast
Three SonicWall bugs, CVE-2024-40766, CVE-2024-53704, and CVE-2025-23006, feed the same outcome: Akira ransomware through the SSL-VPN. In one campaign, the time from SonicWall access to encrypted files was 55 minutes. Several of these bugs walk past MFA.
#sonicwall#cisa-kev#vpn#akira#ransomware -
Analysis · May 20, 2026 · Colten Anderson
SysAid customers got the patch the same week they learned they were already breached
CVE-2023-47246 was a SysAid zero-day before it was a CVE. The Cl0p operator Lace Tempest, fresh off MOVEit, was writing webshells to Tomcat and deploying ransomware while the vendor was still writing the advisory. When the attacker has the bug first, detection matters as much as patching.
#sysaid#cisa-kev#clop#ransomware#incident-response -
Analysis · May 20, 2026 · Colten Anderson
The SolarWinds crew spent late 2023 breaking into build servers. That's not a coincidence.
CVE-2023-42793 is an unauthenticated RCE on JetBrains TeamCity. APT29, the Russian service behind SolarWinds, exploited it at scale, and so did North Korean groups. They weren't after one network. A build server is the supply chain.
#jetbrains#teamcity#cisa-kev#apt29#supply-chain -
Analysis · May 20, 2026 · Colten Anderson
There's no vendor to patch this one. The vulnerable code is inside an app you built.
CVE-2017-11357 is a file-upload-to-RCE flaw in the Telerik UI component. It's not a product on your network you can update; it's a library compiled into web apps your own team shipped, sometimes years ago, often without anyone remembering Telerik is in there.
#telerik#cisa-kev#dependencies#asp-net#web-security -
Analysis · May 20, 2026 · Colten Anderson
A User-Agent string is not authentication, but TerraMaster's NAS treated it like one
To pull the admin password off a TerraMaster NAS, you sent a request with the header User-Agent: TNAS. The API recognized its own app's identifier and handed over the credentials. Chained to a second bug, that's unauthenticated root.
#terramaster#cisa-kev#nas#authentication#api-security -
Analysis · May 20, 2026 · Colten Anderson
The 2024–2026 enterprise-infra bugs, grouped by the mistake that caused them
Oracle WebLogic, SolarWinds Web Help Desk, Citrix Session Recording, Juniper ScreenOS, Outlook, VMware Aria, Brocade, Junos, and more. The recent enterprise-infrastructure entries reduce to the same familiar mechanisms, deserialization, planted credentials, document tricks, broken access control.
#cisa-kev#enterprise-infrastructure#deserialization#access-control#patch-management -
Analysis · May 20, 2026 · Colten Anderson
The 2025 long tail: same six categories, eighty different products
Roundcube and TeleMessage email, Wing FTP and Commvault, Kentico and Adobe Commerce, WatchGuard and PRTG, Rockwell and Trimble ICS, Gladinet and Omnissa. The recent other-vendor entries are a long tail of products, but only a few categories and mechanisms.
#cisa-kev#enterprise-software#ics-ot#patch-management#attack-surface -
Analysis · May 20, 2026 · Colten Anderson
Ransomware crews keep hitting Veeam for the same two reasons
Four Veeam Backup & Replication CVEs feed the same playbook. Attackers target the backup server because it can destroy your recovery option and because it holds the credentials to everything it backs up. CVE-2024-40711 took Akira and Fog from access to ransomware fast.
#veeam#cisa-kev#backup#akira#ransomware -
Analysis · May 20, 2026 · Colten Anderson
The backup agent on every server was ALPHV's way in
Veritas Backup Exec's agent listens on every machine it backs up. Three 2021 CVEs in it, CVE-2021-27876, 27877, and 27878, let ALPHV/BlackCat affiliates get in. Backup infrastructure isn't just a destruction target; its agents are an attack surface on every host.
#veritas#cisa-kev#backup#blackcat#ransomware -
Analysis · May 20, 2026 · Colten Anderson
ESXi handed out admin to a group named 'ESX Admins' and never checked who made it
CVE-2024-37085 is an auth bypass where domain-joined ESXi grants full control to any member of a group called 'ESX Admins,' without verifying the group is legitimate. At least four ransomware crews used it to encrypt hypervisors. ESXi 7.0 isn't getting a patch.
#vmware#esxi#cisa-kev#ransomware#active-directory -
Analysis · May 20, 2026 · Colten Anderson
The virtualization control plane keeps getting RCE'd, and ESXiArgs showed why that matters
vCenter and ESXi run your entire virtual estate. A run of pre-auth RCEs in vCenter (CVE-2021-21972, 21975, 21985, 22005) and the ESXi OpenSLP bugs (CVE-2019-5544, CVE-2020-3992) that fed the ESXiArgs ransomware wave show why the management layer is a crown-jewel target.
#vmware#vcenter#esxi#cisa-kev#ransomware -
Analysis · May 20, 2026 · Colten Anderson
Server-side template injection: when the page renderer runs the attacker's code
CVE-2022-22954 is a template-injection bug in VMware Workspace ONE Access. A template engine meant to render data into a page rendered attacker input into code execution instead, unauthenticated, on the appliance that brokers your single sign-on. Attackers had an exploit 48 hours after the patch.
#vmware#cisa-kev#ssti#identity#web-security -
Analysis · May 20, 2026 · Colten Anderson
A browser bug, sold as a weapon, pointed at journalists
CVE-2022-2294 was a heap overflow in WebRTC, the real-time-comms code inside Chrome and other browsers. It wasn't used for mass crime. A surveillance vendor, Candiru, used it to plant DevilsTongue spyware on journalists in the Middle East. Different threat model, same patch.
#webrtc#chrome#cisa-kev#spyware#browser-security -
Analysis · May 20, 2026 · Colten Anderson
Five hours from public PoC to live exploitation on your monitoring server
CVE-2024-6670 is an unauthenticated SQL injection in WhatsUp Gold. The exploit went public at 5pm UTC; Trend Micro saw the first real attack by 10pm. The tool that watches your whole network became the way in.
#progress#whatsup-gold#cisa-kev#ransomware#patch-management -
Analysis · May 20, 2026 · Colten Anderson
Two years of Patch Tuesdays, one message: the exploited Windows bug is almost always a privilege escalation
Across 2025 and 2026, Microsoft kept fixing already-exploited Windows flaws, storage drivers, Hyper-V, the network stack, even a 20-year-old third-party modem driver. They don't each need their own post. Together they make one point about patching Windows fast.
#microsoft#windows#cisa-kev#privilege-escalation#patch-management -
Analysis · May 20, 2026 · Colten Anderson
A clickable link in a SYSTEM dialog is a SYSTEM shell waiting to happen
CVE-2019-1388 turned a hyperlink in the UAC certificate dialog into a path to NT AUTHORITY\SYSTEM. No exploit code, just clicks: open the cert, click 'Issued by,' and the browser launches as SYSTEM. The lesson is what any interactive element in a privileged process really is.
#microsoft#windows#cisa-kev#privilege-escalation#uac -
Analysis · May 20, 2026 · Colten Anderson
The same crew beat the same defense twice in three months. The patch was the problem.
CVE-2023-24880 let Magniber ransomware bypass SmartScreen with malformed MSI signatures. It worked because Microsoft's earlier fix for nearly the same bug addressed one symptom and left the root cause standing. Narrow patches invite variants, and the attacker just comes back.
#microsoft#windows#cisa-kev#smartscreen#magniber -
Analysis · May 20, 2026 · Colten Anderson
Lazarus didn't bring a vulnerable driver. They used the one already on every Windows PC.
The standard defense against driver-based kernel attacks is a blocklist of known-bad drivers. CVE-2024-21338 routes around it: the vulnerable driver is appid.sys, the AppLocker component Windows ships by default. You can't blocklist a core part of the OS.
#microsoft#windows#cisa-kev#lazarus#kernel -
Analysis · May 20, 2026 · Colten Anderson
The warning your careful users count on, that quietly never fired
CVE-2024-21412 bypasses Windows SmartScreen with a shortcut inside a shortcut. The file looks like a JPEG, the user double-clicks, and the safety prompt that was supposed to appear simply doesn't. It's also a bypass of the previous SmartScreen fix.
#microsoft#windows#cisa-kev#smartscreen#phishing -
Analysis · May 20, 2026 · Colten Anderson
Microsoft said 'no known exploitation.' The exploit may have been three months old.
When Microsoft patched CVE-2024-26169 in March 2024, the advisory said it wasn't aware of attacks. Symantec later found a Black Basta exploit tool built weeks earlier. The technique it used, an IFEO Debugger key, is one you can detect even when you can't patch in time.
#microsoft#windows#cisa-kev#ransomware#detection -
Analysis · May 20, 2026 · Colten Anderson
The FBI dismantled QakBot in 2023. In 2024 it was test-driving a Windows zero-day.
CVE-2024-30051 is a DWM Core Library privilege escalation to SYSTEM, used as a zero-day. Kaspersky tied it to QakBot, the botnet taken down nine months earlier, and found the exploit was already in several groups' hands before the patch.
#microsoft#windows#cisa-kev#qakbot#privilege-escalation -
Analysis · May 20, 2026 · Colten Anderson
The boring privilege-escalation bug is the one that finishes the job
CVE-2024-30088 is a local Windows kernel race condition. It needs an attacker who's already inside, which is exactly why it gets deprioritized. APT34 used it to turn a foothold into SYSTEM, then dropped a password filter to skim every cleartext login.
#microsoft#windows#cisa-kev#privilege-escalation#apt -
Analysis · May 20, 2026 · Colten Anderson
The Print Spooler keeps getting exploited. The fix is usually to turn it off.
PrintNightmare wasn't one bug. The KEV catalog holds a string of Print Spooler entries, from PrintNightmare to SpoolFool to the flaw APT28 paired with GooseEgg. They share a root cause, and for most servers the durable answer isn't a patch, it's disabling a service you don't need.
#microsoft#windows#cisa-kev#print-spooler#hardening -
Analysis · May 20, 2026 · Colten Anderson
The user opened a JPG they could see in the archive. A RAT installed behind it.
CVE-2023-38831 weaponizes the one thing you tell users is safe: opening a file they can see. A WinRAR archive hides a script in a folder named identically to a benign file, and double-clicking the file runs the script. You can't train this away, and WinRAR doesn't auto-update.
#winrar#cisa-kev#phishing#apt#patch-management -
Analysis · May 20, 2026 · Colten Anderson
When the catalog says 'authenticated' and the researcher says it isn't
The KEV entry for CVE-2023-40044 calls it an authenticated attack. The researchers who found it demonstrated remote code execution with no login at all. When your authoritative sources disagree about whether a bug needs credentials, plan around the scarier answer.
#progress#ws-ftp#cisa-kev#cvss#vulnerability-management -
Analysis · May 20, 2026 · Colten Anderson
WSO2 CVE-2022-29464: an upload bug on the box that brokers your APIs and logins
CVE-2022-29464 is an unauthenticated file-upload-to-RCE in WSO2 products. The bug is a familiar one. What makes it serious is where it lives: API management and identity middleware that sits in front of your services and authenticates your users.
#wso2#cisa-kev#api-gateway#identity#file-upload -
Analysis · May 20, 2026 · Colten Anderson
Zerologon: a crypto mistake that hands over the domain in seconds
CVE-2020-1472 is a cryptographic flaw in the Netlogon protocol that lets an unauthenticated attacker with network access to a domain controller reset its machine-account password to empty, becoming domain admin. CVSS 10, no credentials, seconds to exploit.
#microsoft#active-directory#cisa-kev#netlogon#cryptography -
Analysis · May 20, 2026 · Colten Anderson
The Zimbra bug that infected the mail server when it scanned the attachment
In 2022, Zimbra Collaboration Suite got hammered by a cluster of bugs. One didn't even need the victim to click: send a booby-trapped RAR, and the server unpacked it to scan for malware, infecting itself. On-premise email is the keys to the kingdom, and 2022 proved it.
#zimbra#cisa-kev#email#rce#patch-management -
Analysis · May 20, 2026 · Colten Anderson
A 2017 home-router bug got a federal deadline. The fix is to throw the router away.
CVE-2017-6884 is command injection in a Zyxel SOHO router. Zyxel patched it in 2017, but the device is end-of-life, so the real remediation is replacement. It's on the KEV list because EOL edge gear is exactly what gets conscripted into botnets.
#zyxel#cisa-kev#soho-router#end-of-life#botnet -
Analysis · May 19, 2026 · Colten Anderson
YellowKey is unpatched and your travel laptops are exposed today
A public PoC, a TPM-only default, and no patch in sight. TPM+PIN stops the live exploit, but the researcher says a second variant is waiting.
#bitlocker#windows#winre -
Analysis · May 18, 2026 · Colten Anderson
5 Ways GitHub Spent April Lighting Itself On Fire
GitHub logged ten separate outages in one month, including one fixed by turning DNS off and on again. Here are the five most absurd.
#github#availability#ai-scrapers#experiment#cracked-style -
Analysis · May 18, 2026 · Colten Anderson
A valid signature is not a vouch
For 27 days the official DAEMON Tools installer carried a clean Disc Soft signature and a backdoor. The signature did exactly what it was designed to do. That is the problem.
#supply-chain#code-signing#vendor-accountability -
Analysis · May 18, 2026 · Colten Anderson
Microsoft titled it Spoofing. It's session hijacking.
CVE-2026-42897 is the first real test of Exchange Server Subscription Edition's new servicing model. Four days in, the answer is a mitigation that breaks four OWA features and an SU with no ship date.
#exchange#cisa-kev#microsoft#on-premises#cve-2026-42897 -
Analysis · May 18, 2026 · Colten Anderson
KB5089549 fails at 35% because your ESP is full
May's Windows 11 cumulative dies at the boot-file write step on machines with under 10 MB free in the EFI System Partition. Here's the registry fix, the detection query, and the WSUS decision.
#patch-management#windows-11#microsoft#kb5089549#efi-partition -
Analysis · May 18, 2026 · Colten Anderson
Apple's May Wi-Fi kernel bug is bad, but it's probably not Broadpwn
CVE-2026-28819 gets kernel code execution on macOS, but Apple's wording points at a local-app trigger, not a rogue access point. Patch on a 72-hour clock, not a panic clock.
#apple#macos#patch-management -
Analysis · May 17, 2026 · Colten Anderson
Three CitrixBleeds in 30 months is not a streak, it is a code surface
CVE-2026-3055 is the third pre-auth memory disclosure in NetScaler's authentication stack in 30 months. Citrix says they are unrelated. The endpoints, the class, and the exploitation tempo say otherwise.
#Citrix#NetScaler#CitrixBleed#KEV#memory-safety#pre-auth#SAML#secure-by-design -
Analysis · May 17, 2026 · Colten Anderson
Dead.Letter is a Debian and Ubuntu problem, and the popular workaround is wrong
Exim 4.99.3 patches a pre-auth RCE that only exists on GnuTLS-linked builds. Several outlets are recommending a config change that does not close the hole.
#exim#patch-management#debian -
Analysis · May 17, 2026 · Colten Anderson
The malware was signed. The signature was real. The package was poison.
TanStack's npm release pipeline published 84 malicious package versions with valid SLSA provenance. The attestation was correct. It just wasn't the question that mattered.
#supply-chain#npm#github-actions -
Analysis · May 15, 2026 · Colten Anderson
When breaking the maintenance window is cheaper than waiting
The change board exists to make change safer, not slower. Here's the operational math for when the window has to move.
#patch-management#change-management#vulnerability-management -
Field Note · May 15, 2026 · Colten Anderson
A defensible software inventory you can build with the tools you already have
PowerShell, dpkg, system_profiler, Nmap, and a git repo will produce a weekly software inventory that joins cleanly against the CISA KEV catalog. Here are the parts that look right and aren't.
#asset-inventory#vulnerability-management#powershell#nmap#kev#sbom -
Analysis · May 15, 2026 · Colten Anderson
The patch ring math stops working at fifty endpoints
Enterprise ring guidance assumes a fleet big enough that 5% is a meaningful sample. At 50 machines, it's 2.5 boxes.
#patch-management#smb#deployment-rings -
Field Note · May 15, 2026 · Colten Anderson
Patching Windows when your test ring is two laptops
Microsoft's deployment-ring guidance was written for orgs where 5% of the fleet is dozens of machines. Here's what the model actually buys you when 5% is two laptops, and what to substitute for the rest.
#windows-update#patch-management#autopatch#intune#small-business -
Field Note · May 15, 2026 · Colten Anderson
Recovering from a bad Intune deployment without making it worse
Stop the spread, unwind the damage, verify it took. A failure-mode-to-action playbook for when a config profile, app push, or CA policy goes sideways.
#intune#endpoint-management#incident-response#microsoft-365 -
Field Note · May 15, 2026 · Colten Anderson
A 30-minute Patch Tuesday triage you can actually run
How to get from 150 CVEs to the 4-8 that change your week, using only public signals and a clock.
#patch-tuesday#microsoft#triage#kev -
Field Note · May 15, 2026 · Colten Anderson
Nine PowerShell checks before you trust a Windows host
A short, native-PowerShell audit a Windows admin can run on any host in about ten minutes. The bad answers are unambiguous and the fixes are cheap.
#windows#powershell#hardening#audit#active-directory -
Analysis · May 14, 2026 · Colten Anderson
Rapid7 found a second CVSS 10 in Cisco SD-WAN while researching the first
Two unauthenticated auth bypasses in the same Cisco vdaemon in under three months, both being exploited by the same actor that has been sitting in critical-infrastructure fabrics since 2023.
#cisco#sd-wan#vulnerability -
Analysis · May 14, 2026 · Colten Anderson
Fragnesia is the patch you already deployed, bypassed
If you rolled the Dirty Frag kernel update last week and called it done, your fleet is exposed again. Worse, patched hosts may still hand out root shells until you drop the page cache.
#linux-kernel#patch-management#privilege-escalation -
Analysis · May 14, 2026 · Colten Anderson
Vercel shipped the framework. You're shipping the patch
CVE-2026-44578 is a CVSS 8.6 SSRF in self-hosted Next.js. The fix for 13.x and 14.x users is a major-version migration, filed against your product team as a Dependabot chore.
#nextjs#ssrf#vercel#self-hosting -
Analysis · May 14, 2026 · Colten Anderson
Does this CVE actually apply to you? Three filters before you patch
Single-score triage fails in both directions: 10.0s that don't apply, 4.3s that get exploited for 13 days. Three filters reduce the queue.
#prioritization#triage#cvss#kev#epss#ssvc -
Analysis · May 13, 2026 · Colten Anderson
Daybreak shipped without a single number of its own
OpenAI announced an end-to-end vulnerability detection and patching platform on May 12, then borrowed every performance figure from its predecessors. The borrowed figures don't help its case.
#openai#ai-security#vendor-claims -
Analysis · May 12, 2026 · Colten Anderson
What 14 days of TeamPCP told us about registry defense in 2026
Five compromises across two ecosystems in six weeks, then a 169-package npm wave on May 11. One threat actor, two very different defensive postures. The pattern is the point.
#npm#pypi#supply-chain#software-dependencies#ci-cd -
Analysis · May 11, 2026 · Colten Anderson
Cisco is now telling you the patch doesn't clean the box
Cisco's April 23 PSIRT advisory says the ArcaneDoor implant survives upgrading to the September 2025 fixes for CVE-2025-20333 and CVE-2025-20362. Reimage, do not patch.
#cisco#asa#firepower#arcanedoor#perimeter-security#cve-2025-20333#cve-2025-20362 -
Analysis · May 11, 2026 · Colten Anderson
The CVSS 4.3 that APT28 was already using
Microsoft shipped the fix for CVE-2026-32202 without an exploitation flag while Russian state actors had a five-month head start. Vendor-tag triage missed it. The federal deadline is tomorrow.
#cve-2026-32202#apt28#ntlm#windows#cisa-kev#incomplete-patch -
Analysis · May 11, 2026 · Colten Anderson
The .de outage was a TLD postmortem, not a patch you missed
DENIC's signing pipeline shipped two-thirds bad signatures during a routine ZSK rotation on May 5. Nothing in your environment caused it, and nothing in your environment could prevent it. Here's what you can still change at your resolver.
#dns#dnssec#denic#tld#outage-postmortem#operations -
Analysis · May 11, 2026 · Colten Anderson
Kubernetes 1.36 is the upgrade that quietly rewrites your RBAC
The headline features in 1.36 are user namespaces and SELinux. The thing that will actually bite you on Monday is a single locked-on feature gate that turns every nodes/proxy grant in your cluster into an audit finding.
#kubernetes#selinux#container-security#upgrade-planning#kubelet#rbac -
Analysis · May 11, 2026 · Colten Anderson
The June 2026 Secure Boot cliff: tomorrow is your last clean window
Three Microsoft Secure Boot certificates from 2011 expire in June. May 12 is the last Patch Tuesday before the cliff, and the registry trigger isn't going to set itself.
#secure-boot#windows#uefi#patch-management#microsoft -
Analysis · May 10, 2026 · Colten Anderson
Array Networks patched in a week and forgot to build a security program
CVE-2023-28461 is a CVSS 9.8 auth bypass on an SSL VPN that Earth Kasha was already exploiting. The fix shipped fast. The disclosure infrastructure around it doesn't exist.
#vendor-accountability#ssl-vpn#disclosure#cve-2023-28461#array-networks#kev -
Analysis · May 10, 2026 · Colten Anderson
The most expensive sentence Microsoft can write is 'no customer action required'
CVE-2026-33823 ships with a server-side fix and a 9.6 CVSS, but the audit log doesn't record portal-layer access. The patch is free. The compliance work isn't.
#microsoft-teams#cloud-cve#compliance -
Analysis · May 10, 2026 · Colten Anderson
The seven-year gap is the story, not the CVE
Microsoft patched CVE-2018-8639 in December 2018. CISA added it to the KEV catalog in March 2025. The interesting number isn't the bug's age. It's the distance between when a fix shipped and when the exposed fleet was acknowledged.
#cve-2018-8639#cisa-kev#windows#patch-management#legacy-systems -
Analysis · May 10, 2026 · Colten Anderson
The second bug is the easy one now
Two unrelated actors weaponized the same Task Scheduler zero-day at the same time. The reason isn't sophistication, it's that missing-auth on local RPC is sitting under most of Windows.
#windows#exploitation-trends#rpc -
Analysis · May 10, 2026 · Colten Anderson
Zyxel patched CVE-2024-11667 in September. They named it in November
The fix shipped on September 3, 2024. The CVE assignment came eleven weeks later, after Helldown was already in production networks. The customers who patched on time still got compromised.
#zyxel#ransomware#vendor-disclosure -
Analysis · May 10, 2026 · Colten Anderson
SimpleHelp CVE-2024-57727: a seven-day patch and a sixteen-month leak
SimpleHelp shipped a fix in seven days from full disclosure. Then they posted it to a forum. Ransomware affiliates have been pulling hashed admin credentials out of unpatched servers ever since.
#simplehelp#rmm#msp#cve-2024-57727#cve-2024-57726#cve-2024-57728#cisa-kev#ransomware#dragonforce#medusa#supply-chain#horizon3 -
Analysis · May 9, 2026 · Colten Anderson
Skip the optional preview: KB5083631 isn't worth your Tuesday morning
May 12 ships the same 34 fixes plus the month's security patches in one tested package. The preview brings the same risk for none of the upside.
#patch-management#windows-11#microsoft#backup#bitlocker -
Analysis · May 8, 2026 · Colten Anderson
Cleo shipped a fix in October. Cl0p was bypassing it by December.
CVE-2024-50623 was patched in 5.8.0.21 on October 27. By December 3, Huntress had a working PoC against fully patched hosts and Cl0p was running it in production. This is the fifth MFT vendor in five years to hand Cl0p the same playbook.
#cleo#cleo-harmony#cleo-vltrader#cleo-lexicom#cve-2024-50623#cve-2024-55956#cisa-kev#cl0p#clop-ransomware#managed-file-transfer#ransomware -
Analysis · May 8, 2026 · Colten Anderson
Qlik patched the smuggling bug, then Praetorian beat it with one extra letter
On August 29, 2023, Qlik shipped a literal-string filter for chunked transfer encoding. Three weeks later Praetorian sent tchunked, the desync came back, and Cactus ransomware spent the next two months harvesting the administrators who thought they were done patching.
#qlik#qlik-sense#cve-2023-41265#cve-2023-41266#cve-2023-48365#cisa-kev#cactus-ransomware#http-request-smuggling#patch-bypass#praetorian -
Analysis · May 8, 2026 · Colten Anderson
Mitel MiCollab keeps shipping the same path-traversal bug class
watchTowr published a working unauth file-read chain on December 5, 2024 with one of the two CVEs still a 0-day. The pattern across NPM, ReconcileWizard, and AWV is structural, and operators tolerate it because UC is the most upgrade-averse tier in the enterprise.
#mitel#micollab#cve-2024-41713#cve-2024-55550#cve-2022-29499#cve-2024-35286#cisa-kev#watchtowr#path-traversal#unified-communications -
Analysis · May 8, 2026 · Colten Anderson
Five critical Fortinet CVEs in 28 months is not a streak of bad luck
Three heap overflows, two auth bypasses, all pre-auth, all ransomware-linked. The pattern in FortiOS and FortiProxy is structural, and patching alone has not been enough to remove attacker access.
#Fortinet#FortiOS#SSL-VPN#KEV#ransomware#perimeter-security#memory-safety#silent-patching -
Analysis · May 8, 2026 · Colten Anderson
Three root shells in seven months. All from the same firewall.
CVE-2024-3400, CVE-2024-0012, and CVE-2024-9474 gave attackers unauthenticated root on Palo Alto firewalls twice in 2024. The pattern isn't bad luck. It's the architecture.
#palo-alto#cisa-kev#firewall#zero-day#ransomware#pan-os -
Analysis · May 8, 2026 · Colten Anderson
Your LiteLLM proxy needs to be on 1.83.10 by May 11
CISA gave a three-day deadline on a pre-auth SQL injection in LiteLLM. The patch is one version bump; the rotation work after it is the real job.
#litellm#kev#patch-management -
Analysis · May 8, 2026 · Colten Anderson
The researcher who reported two Windows bugs to Microsoft was exploiting a third
CVE-2025-26633 turns MMC's localization feature into a code execution vector. EncryptHub exploited it as a zero-day while simultaneously disclosing other vulnerabilities to Microsoft for credit.
#windows#mmc#cve-2025-26633#zero-day#ransomware#encrypthub#patch-tuesday#msc-eviltwin -
Analysis · May 8, 2026 · Colten Anderson
Broadcom turned an ESXi zero-day into a patch-access crisis
CVE-2025-22225 was exploited for over a year before Broadcom patched it. Then perpetual license holders couldn't download the fix.
#vmware#esxi#cve-2025-22225#zero-day#ransomware#broadcom#vm-escape#hypervisor -
Analysis · May 8, 2026 · Colten Anderson
Ivanti Connect Secure: the perimeter that keeps breaking
Five KEV-listed Ivanti Connect Secure bugs in fifteen months, all ransomware-tagged, all on the unauthenticated path. The pledge bought goodwill. The code did not change.
#ivanti#ivanti-connect-secure#pulse-connect-secure#cve-2023-46805#cve-2024-21887#cve-2024-21893#cve-2025-0282#cve-2025-22457#cisa-kev#ransomware#unc5221#secure-by-design#cwe-121#memory-safety -
Analysis · May 8, 2026 · Colten Anderson
Ivanti EPMM has produced a confirmed zero-day every year since 2023. Here's the full chain.
Twelve CVEs. Four exploitation waves. Three years. One product line. A complete accounting of Ivanti EPMM's zero-day history, from the Norwegian government breach to this week's credential chain.
#ivanti#epmm#cisa-kev#credential-chain#zero-day#MDM#unc5221 -
Analysis · May 7, 2026 · Colten Anderson
CISA says patch by Friday. Palo Alto's fix ships next Tuesday.
CVE-2026-0300 is an unauthenticated RCE in PAN-OS Captive Portal, exploited since April 9 by a state-aligned actor. The KEV deadline is May 9. The first patch lands May 13. Here's what to do with the four days in between.
#palo-alto#cisa-kev#zero-day#firewall#patch-management -
Analysis · May 6, 2026 · Colten Anderson
Citrix shipped CitrixBleed again
Citrix shipped the same pre-auth memory disclosure bug class it patched in 2023. Same binary, same attack surface, same session token leakage. Its own post-patch guidance still doesn't invalidate the tokens attackers actually steal.
#citrix#netscaler#cve-2025-5777#citrixbleed#ransomware#memory-safety#edge-devices -
Analysis · May 6, 2026 · Colten Anderson
CrushFTP chose the narrative over its customers
CrushFTP tried to keep a CVSS 9.8 auth bypass quiet. The disclosure mess that followed, two CVEs, public PoC code, and CEO threats, helped attackers move faster.
#disclosure#MFT#CrushFTP#CVE-2025-31161#KEV#ransomware -
Analysis · May 6, 2026 · Colten Anderson
Fortinet encrypted your config backups with 'Mary had a littl' for six years
Every FortiGate encrypted config backups with the same AES key for years. Akira ransomware automated the decryption. Fortinet keeps shipping this class of bug.
#fortinet#fortios#cve-2019-6693#hard-coded-credentials#cwe-798#ransomware#akira#cisa-kev#configuration-security -
Analysis · May 6, 2026 · Colten Anderson
SAP NetWeaver was owned for ten weeks before anyone said anything
Five threat groups were already inside SAP NetWeaver when the emergency patch shipped. One confirmed victim reported multi-billion dollar profit impact. SAP's initial workaround guidance was later marked 'Do Not Use.'
#sap#netweaver#cve-2025-31324#cisa-kev#zero-day#webshell#patch-management#china#ransomware -
Analysis · May 6, 2026 · Colten Anderson
Six zero-days in three years: the CLFS pattern Microsoft can't outrun
Microsoft patched a CLFS zero-day on April 8 but left Windows 10 without a fix for five weeks. Two unrelated ransomware groups were already using it. It was the sixth CLFS zero-day since 2022.
#windows#clfs#cve-2025-29824#zero-day#ransomware#privilege-escalation#patch-tuesday#windows-10 -
Analysis · May 5, 2026 · Colten Anderson
Oracle blamed its customers for a zero-day it hadn't patched
Oracle's first public statement during active Cl0p exploitation told customers the breach was their fault for not applying a patch that didn't exist. The correction came Saturday night, behind a paywall.
#oracle#cisa-kev#zero-day#ransomware#erp#disclosure -
Analysis · May 5, 2026 · Colten Anderson
BeyondTrust RS/PRA hit again. Same endpoint, same bug class, 15 months later.
The researcher who found CVE-2026-1731 did it by asking one question about the December 2024 fix: did the same pattern exist elsewhere? It did. Third critical BeyondTrust RCE in 15 months, confirmed ransomware, CISA gave you 3 days.
#beyondtrust#cisa-kev#command-injection#ransomware#remote-access#patch-management -
Analysis · May 5, 2026 · Colten Anderson
Your firewall management console was the breach. Cisco FMC CVE-2026-20131.
CVSS 10.0 unauthenticated RCE in Cisco FMC was exploited as a zero-day for 36 days. Here's what the upgrade actually looks like.
#cisco#cisa-kev#deserialization#firewall#ransomware#patch-management -
Analysis · May 5, 2026 · Colten Anderson
Exchange's deserialization problem didn't start in 2023. It still isn't fixed.
A ransomware group picked up a three-year-old Exchange RCE because scanning at scale still finds unpatched servers. The bug isn't the story. The patching economics are.
#exchange#cisa-kev#deserialization#patch-management#ransomware#on-premises -
Analysis · May 5, 2026 · Colten Anderson
GoAnywhere MFT gets its third critical RCE in three years
Storm-1175 was exploiting CVE-2025-10035 two days before Fortra even shipped the hotfix to customers. Under 24 hours from initial access to ransomware. GoAnywhere's third year in a row.
#goanywhere-mft#cve-2025-10035#ransomware#fortra#managed-file-transfer#storm-1175#deserialization -
Analysis · May 5, 2026 · Colten Anderson
Cl0p chained an Oracle EBS SSRF into a mass extortion campaign. Your patch window is 21 days.
CVE-2025-61884 is a pre-auth SSRF in Oracle E-Business Suite that Cl0p weaponized into a full RCE chain hitting 100+ organizations. Here's what patching EBS actually looks like under a KEV deadline.
#oracle#cisa-kev#ssrf#ransomware#erp#patch-management -
Analysis · May 5, 2026 · Colten Anderson
PaperCut's other bug just became a ransomware vector again
CVE-2023-27351, the auth bypass that lived in CVE-2023-27350's shadow, is back. Storm-1175 is deploying Medusa ransomware through it with sub-24-hour exploitation tempo. CISA added it to KEV in April 2026. If you patched the RCE in 2023 and moved on, check whether the auth bypass actually closed.
#papercut#ransomware#cisa-kev#authentication-bypass#medusa#patch-management -
Analysis · May 5, 2026 · Colten Anderson
React2Shell turned every Next.js App Router deployment into a pre-auth RCE target
Lachlan Davidson reported CVE-2025-55182 to Meta on a Friday. By the following Thursday, ransomware groups were deploying payloads within one minute of initial access. A 200-byte POST, CVSS 10, 137,000 exposed instances, and most developers never knew their frontend had server-side attack surface.
#react#nextjs#cisa-kev#ransomware#deserialization#react-server-components#supply-chain -
Analysis · May 5, 2026 · Colten Anderson
SharePoint's two-week window: patched servers were still exploitable
Organizations that patched SharePoint on July 9 did everything right and were still vulnerable. Microsoft's first fix was incomplete, and ransomware operators had the gap memorized.
#sharepoint#cve-2025-49704#cve-2025-49706#cve-2025-53770#ransomware#microsoft#patch-bypass#toolshell -
Analysis · May 5, 2026 · Colten Anderson
The 6.5 that enabled 400 compromises: authentication bypasses and the CVSS blind spot
CVE-2025-49706 scored CVSS 6.5. It enabled unauthenticated RCE across 400+ SharePoint servers. Authentication bypasses are consistently underscored, and consistently the vulnerability class that turns a bad bug into a mass-exploitation campaign.
#sharepoint#cve-2025-49706#authentication-bypass#cvss#cwe-287#microsoft#toolshell -
Analysis · May 5, 2026 · Colten Anderson
The patch that wasn't: why SharePoint's fix needed a fix
CVE-2025-53770 bypassed Microsoft's July patch for SharePoint within days. The problem isn't bugs. It's that incomplete fixes are a pattern, and patch compliance frameworks can't measure patch quality.
#sharepoint#cve-2025-53770#patch-bypass#microsoft#deserialization#incomplete-patch -
Analysis · May 5, 2026 · Colten Anderson
SmarterMail fixed a CVSS 10 and told no one for two months
CVE-2025-52691 is a pre-auth RCE in SmarterMail's file upload API. SmarterTools patched it silently in October 2025 with no CVE, no advisory, and release notes that said 'critical security fixes.' watchTowr found the silent fix two months later. Here's why that matters.
#smartertools#smartermail#cisa-kev#silent-patching#file-upload#vulnerability-disclosure#ransomware -
Analysis · May 5, 2026 · Colten Anderson
48 hours from patch to exploitation: CVE-2026-23760 and the window that doesn't exist anymore
SmarterMail's patch shipped January 15. Attackers decompiled the .NET assemblies, found the fix, built a working exploit, and were inside production systems by January 17. Then they breached SmarterTools itself.
#smartertools#smartermail#cisa-kev#ransomware#authentication-bypass#time-to-exploit#patch-management -
Analysis · May 5, 2026 · Colten Anderson
SmarterMail's ConnectToHub API gave attackers SYSTEM in a single POST request
CVE-2026-24423 is an unauthenticated RCE in SmarterMail's ConnectToHub API. No credentials, no interaction, CVSS 9.8, confirmed ransomware. One of three critical SmarterMail CVEs in ten days. Here's what happened and what to do about it.
#smartertools#smartermail#cisa-kev#ransomware#missing-authentication#email-server#unauthenticated-rce -
Analysis · May 5, 2026 · Colten Anderson
TeamCity's path traversal took two years to reach KEV. That's a long time to leave a CI server exposed.
CVE-2024-27199, a path traversal in JetBrains TeamCity On-Premises, was patched in March 2024 and exploited by BianLian ransomware within days. CISA added it to KEV in April 2026 with a May 4 federal deadline. If you're still below 2023.11.4, this is two years overdue.
#teamcity#jetbrains#cisa-kev#path-traversal#ransomware#bianlian#ci-cd#patch-management -
Analysis · May 4, 2026 · Colten Anderson
Three hours was the good outcome: npm's trust model and the Axios compromise
A DPRK threat actor backdoored two Axios versions on npm. Socket flagged the malicious dependency in six minutes. Nothing stopped the downstream publish fifteen minutes later. The system worked exactly as designed.
#npm#supply-chain#axios#dprk#software-dependencies -
Analysis · May 3, 2026 · Colten Anderson
50 CVEs in 18 months is not a growing pain. It's a design choice the industry keeps making.
MCP went from unknown to default AI integration in under two years. The vulnerability count, the OWASP Top 10, and the simultaneous client failures tell a story about what happens when adoption is the only metric.
#mcp#oauth#ai-security#supply-chain#agentic-ai -
Analysis · May 3, 2026 · Colten Anderson
Spirit Airlines is dead. Its attack surface isn't.
The security story isn't that an airline went bankrupt. It's what happens to 132 APIs, years of customer PII, and a cloud footprint when a company dies overnight and nobody is left to decommission it.
#abandoned-infrastructure#dns#subdomain-takeover#supply-chain#data-protection -
Analysis · May 3, 2026 · Colten Anderson
Copy Fail is a 732-byte root shell. Patch your Linux fleet this week.
CVE-2026-31431 is a deterministic privilege escalation in the Linux kernel affecting versions 4.14 through 6.19. A Python script gives any local user root. Every major distro is affected, containers don't help, and the mitigation is trivial.
#linux#kernel#cve-2026-31431#privilege-escalation#containers#kubernetes#cisa-kev -
Analysis · May 3, 2026 · Colten Anderson
Cerdigent was a false positive. Check what Defender actually removed.
Defender definition 1.449.424.0 flagged two legitimate DigiCert root CA certificates as a high-severity trojan. The alert was a false positive, but if auto-remediation ran before the fix shipped, your certificate store may now be missing trust anchors that TLS depends on.
#defender#microsoft#windows#certificates#digicert#false-positive -
Analysis · May 1, 2026 · Colten Anderson
The security work that landed on ops
Cloud shared responsibility, compliance mandates, and insecure defaults have quietly moved security execution onto ops teams that were never staffed for it.
#shared-responsibility#ops#burnout#compliance#patch-management -
Analysis · May 1, 2026 · Colten Anderson
People problems wearing a server badge
The sysadmin job was sold as infrastructure. The actual job is diplomacy, and the burnout numbers show it.
#career#communication#burnout#workplace-culture#soft-skills -
Analysis · May 1, 2026 · Colten Anderson
Microsoft: the Patch Day cinematic universe
Licensing, patches, email blocking, Copilot, Recall, Windows replacement. Every subplot lands on the same sysadmin's desk.
#microsoft#licensing#windows#copilot#opinion -
Analysis · May 1, 2026 · Colten Anderson
The feedback loop is broken
Executives keep making the same categories of bad IT decisions because the consequences land on operators, not decision-makers. The pattern is structural, not accidental.
#governance#risk-management#executive-decisions#IT-operations -
Analysis · May 1, 2026 · Colten Anderson
Your security vendor's AI isn't making you safer. It's making you tired.
76% of cybersecurity professionals say the AI landscape is overwhelmed by overpromotion. The operational cost of that fatigue is starting to show up in the places that matter.
#ai#vendor-hype#soc#burnout#tool-sprawl -
Analysis · May 1, 2026 · Colten Anderson
The most dangerous sentence in a code comment is 'this should never happen'
From Therac-25 to CrowdStrike, the same pattern keeps producing catastrophic failures: an engineer reasons that a condition is impossible, skips the guard, and the system outgrows the assumption.
#reliability#architecture#incident-patterns -
Analysis · May 1, 2026 · Colten Anderson
Hotpatch goes default in Autopatch. You have 10 days.
Microsoft flips hotpatch on by default for all Autopatch tenants May 11. If you haven't inventoried your fleet against the requirements, you're about to get a split patching model you didn't plan for.
#autopatch#hotpatch#microsoft#patching#windows-11 -
Analysis · May 1, 2026 · Colten Anderson
A 4.3 that mattered: the 13-day gap between patch and exploitation flag
Microsoft patched CVE-2026-32202 on April 14 without marking it exploited. APT28 had been using it since at least December. The gap between those two facts is where triage models break.
#ntlm#microsoft#apt28#cisa-kev#triage#patch-tuesday#windows -
Field Note · May 1, 2026 · Colten Anderson
Patch CVE-2026-40372, then rotate the keys
The ASP.NET Core DataProtection fix stops new forged payloads. It does not clean up tokens your app may have issued while the vulnerable code was live.
#aspnet-core#dotnet#cve-2026-40372#patch-management -
Analysis · May 1, 2026 · Colten Anderson
The same LDAP injection, in two firewalls, in the same month
OPNsense shipped a textbook LDAP filter injection that hid for eleven years. WatchGuard disclosed the same class of flaw weeks later. The pattern is not coincidence.
#ldap#opnsense#network-security -
Analysis · May 1, 2026 · Colten Anderson
The Vercel breach is the Heroku/Travis CI playbook, rerun through an AI tool
A compromised OAuth token at a small AI productivity company gave attackers a path into Vercel's internal systems. The structural pattern is four years old. AI tools are making it worse.
#oauth#supply-chain#vercel#ai-tools#credential-theft -
Analysis · May 1, 2026 · Colten Anderson
Anthropic's MCP gives every downstream app unauthenticated RCE, and they called it expected behavior
The Model Context Protocol's STDIO transport passes user input directly into subprocess execution with no sanitization. OX Security found 14+ CVEs across the ecosystem. Anthropic declined to patch.
#mcp#anthropic#remote-code-execution#supply-chain#ai-security -
Analysis · May 1, 2026 · Colten Anderson
Windows Defender is the attack surface now, and two of the three exploits don't have patches
Three tools dropped in April turn Defender's own privileged operations into privilege escalation and detection evasion. Microsoft patched one. The other two work on fully patched systems.
#windows-defender#cve-2026-33825#privilege-escalation#detection-evasion#microsoft -
Analysis · Apr 30, 2026 · Colten Anderson
CVE-2026-41940 isn't just a cPanel bug. It's a design assumption that shipped for a decade.
A CRLF injection in cPanel's session writer gave attackers unauthenticated root in four requests. The fix landed. The architecture question hasn't. Updated May 4 with exploitation scale: 44,000+ hosts compromised, ransomware, botnet, and state-sponsored campaigns confirmed.
#cpanel#cve-2026-41940#architecture#zero-day#ransomware#exploitation -
Analysis · Apr 29, 2026 · Colten Anderson
Microsoft April 2026 Patch Tuesday: the CVE count is the wrong unit
Roughly 160+ CVEs landed in April. About six of them change what an IT team does this week.
#patch-tuesday#microsoft#prioritization#april-2026 -
Field Note · Apr 29, 2026 · Colten Anderson
Best practices for patch prioritization in a hybrid environment: start with business impact
Severity scores tell you which CVE is nastiest. Business impact tells you which one matters.
#prioritization#business-impact#hybrid#framework -
Analysis · Apr 28, 2026 · Colten Anderson
What patching looks like when you support the whole mess: endpoints, M365, identity, browsers, VPN, and line-of-business tools
Patching isn't Windows Updates anymore. A tour of the six surfaces a real shop patches every week.
#patch-surface#endpoints#m365#identity#vpn -
Field Note · Apr 28, 2026 · Colten Anderson
Patch now, patch later, ignore for now: the triage model real IT teams actually need
A three-bucket triage model for sysadmins who don't own a vulnerability scanner and aren't going to buy one.
#triage#prioritization#framework -
Analysis · Apr 28, 2026 · Colten Anderson
Why most patch summaries fail the people who actually have to do the work
Vendor advisories are written for completeness. They're not written for the operator triaging a CISA KEV ticket before lunch.
#triage#newsletter#editorial