Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver …
Two things live here.
Advisories — a running brief on the vulnerabilities that matter to people running network and edge infrastructure. Every CISA KEV addition, plus critical flaws in firewalls, VPN gateways, routers and management planes. What it is, what to do about it, and what to tell your leadership — in that order. Sources and the checks every post passes are set out in the methodology.
The workshop — longer write-ups from a home lab: virtualisation, self-hosted AI image and speech generation, build automation, and the things that broke on the way. Slower, and considerably less urgent.
Latest advisories
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd …
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
A path traversal bug in Cisco Secure Email Gateway’s attachment-scanning feature lets an attacker email a crafted file to the gateway and gain root on the underlying OS without logging in.
Palo Alto Networks PAN-OS Code Injection Vulnerability
An authenticated attacker who can reach the PAN-OS management interface can inject code that runs as root on PA-Series, VM-Series, or Panorama firewalls, and the flaw is already being exploited.
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
An unauthenticated attacker can spoof the login check on Ivanti Connect Secure and run arbitrary commands on the gateway, with no credentials or user interaction required, and it’s already being exploited.
Microsoft Windows Command Injection Vulnerability
A command injection flaw in Windows Shell lets an attacker who tricks a user into opening a crafted file or link bypass a security feature, with full confidentiality, integrity and availability impact — and it’s already being exploited.
From the workshop
Three AI reviews of the same project, and where they disagreed
I gave three AI models the same data about a project of mine and asked each, separately, why it was not growing. The consensus turned out to be the least useful part.
Auditing a homelab after it breaks: what the documentation got wrong
After a failure I went through my own infrastructure line by line and compared it to my notes. Six things were wrong, and all six were wrong in the same direction.
Proxmox on a second-hand workstation
Why an old dual-socket workstation beats a mini PC for a home hypervisor, and the three decisions that determine whether the thing is still running in a year.