Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-118193 GiveWP GiveWP★CVE-2026-122299 Dulwich Dulwich★CVE-2026-122302 Kyverno Kyverno★CVE-2026-122303 Kyverno Kyverno★CVE-2026-122304 Kyverno Kyverno★CVE-2026-122305 Kyverno Kyverno★CVE-2026-122306 Kyverno Kyverno★CVE-2026-122307 Kyverno Kyverno★CVE-2026-122308 Kyverno Kyverno★CVE-2026-122310 Kyverno KyvernoPatch forecast · Nov 5
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 43 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
GiveWP GiveWP
GiveWP up to and including 4.19.1 lets authenticated GiveWP Managers assign privileged WordPress roles to every new donor account, up to and including Administrator through the settings import path. Wordfence rates it CVSS 3.1 8.8.
Dulwich Dulwich
Dulwich before 1.2.20 resolves a duplicate tree header in a commit object to the last occurrence instead of the first, diverging from core git. Poetry 2.5.1 ships this version and uses dulwich by default, so a crafted commit can make reviewers see a benign tree while Poetry installs a malicious one. Dulwich rates it CVSS 3.1 8.8.
Kyverno Kyverno
Kyverno before 1.19.2 checks generate-rule admission against the controller's permissions instead of the author's, so a namespace admin can make the background controller create or clone resources in other namespaces or at cluster scope. Kyverno rates it CVSS 3.1 9.8.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog