Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-101117 IBM WebSphere Extreme Scale★CVE-2026-105467 IBM QRadar★CVE-2026-107331 IBM DataStage on Cloud Pak for Data★CVE-2026-110273 IBM TRIRIGA Application Platform★CVE-2026-114464 IBM Process Mining★CVE-2026-116499 IBM Qiskit SDK★CVE-2026-116501 IBM Qiskit SDK★CVE-2026-117545 IBM webMethods Integration Server★CVE-2026-118904 IBM webMethods Integration Server★CVE-2026-123543 OpenIdentityPlatform OpenAMPatch forecast · Nov 8
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 80 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
IBM WebSphere Extreme Scale
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration, rated critical at CVSS 9.1.
IBM QRadar
IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to reflected cross-site scripting, where a victim must open a specifically crafted URL while authenticated to QRadar to trigger it, rated high at CVSS 8.1.
IBM DataStage on Cloud Pak for Data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability, rated critical at CVSS 9.9.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog