Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-109469 Microsoft Entra Device Registration★CVE-2026-123218 IBM Aspera Faspex★CVE-2026-16720 IBM API Connect★CVE-2026-16884 IBM API Connect★CVE-2026-16920 IBM API Connect★CVE-2026-17117 IBM API Connect★CVE-2026-17132 IBM API Connect★CVE-2026-17278 IBM API Connect★CVE-2026-17297 IBM API Connect★CVE-2026-17299 IBM API ConnectPatch forecast · Nov 7
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 60 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
Microsoft Entra Device Registration
Microsoft Entra Device Registration lets an unauthorized attacker elevate privileges over the network through an authorization bypass using a user-controlled key, rated critical at CVSS 10.0 with changed scope and no privileges or user interaction required.
IBM Aspera Faspex
IBM Aspera Faspex 5.0.0 through 5.0.19 lets an authorized user craft a specific message that bypasses user authorization and gains full administrative privileges, rated critical at CVSS 9.8; IBM fixed it in 5.0.19 PL1.
IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 does not sufficiently enforce authentication against a connected directory service, letting a remote attacker obtain valid access tokens for other users and assume their identity, rated critical at CVSS 9.8.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog