A spoofable X-GPUStack-Real-IP header lets a remote attacker impersonate the loopback admin account in GPUStack, gaining full administrative control and code execution with no credentials.
Two things live here.
Advisories — a running brief on the vulnerabilities that matter to people running network and edge infrastructure. Every CISA KEV addition, plus critical flaws in firewalls, VPN gateways, routers and management planes. What it is, what to do about it, and what to tell your leadership — in that order. Sources and the checks every post passes are set out in the methodology.
The workshop — longer write-ups from a home lab: virtualisation, self-hosted AI image and speech generation, build automation, and the things that broke on the way. Slower, and considerably less urgent.
Latest advisories
IBM Aspera Faspex Incorrect Authorization Vulnerability
IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
On Alpine Linux and other musl-based systems running sshd without PAM, a password-handling bug lets certain accounts log in with any password 256 to 1024 characters long.
SignalWire FreeSwitch Code Injection Vulnerability
A malformed SIP MESSAGE field lets any authenticated SIP account, including stock directory users with no password set, run operating system commands as the FreeSWITCH daemon.
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
SonicWall’s SSLVPN service lets users authenticate with an alternate credential instead of SAML, meaning MFA enforced only through SAML can be sidestepped by anyone holding a valid non-SAML login.
Apple Multiple Products Improper Authentication Vulnerability
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer …
From the workshop
Three AI reviews of the same project, and where they disagreed
I gave three AI models the same data about a project of mine and asked each, separately, why it was not growing. The consensus turned out to be the least useful part.
Auditing a homelab after it breaks: what the documentation got wrong
After a failure I went through my own infrastructure line by line and compared it to my notes. Six things were wrong, and all six were wrong in the same direction.
Proxmox on a second-hand workstation
Why an old dual-socket workstation beats a mini PC for a home hypervisor, and the three decisions that determine whether the thing is still running in a year.