Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-120315 LobeHub LobeHub Chat★CVE-2026-114217 Konflux Konflux CI★CVE-2026-116086 Konflux Konflux CI★CVE-2026-116964 Konflux Konflux CI★CVE-2026-117681 Konflux Konflux CI★CVE-2026-119977 WordPress WordPress★CVE-2026-120201 dromara Jpom★CVE-2026-103039 RocketGenius Gravity Forms★CVE-2026-119408 n8n n8n★CVE-2026-119419 CakePHP CakePHPPatch forecast · Nov 2
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 43 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
LobeHub LobeHub Chat
An authenticated LobeHub Chat user can supply a traversal filename that escapes the temp directory during document parsing, overwriting application files such as startServer.js for remote code execution. LobeChat server-database deployments from 1.84.26 before 2.1.49 are affected.
Konflux Konflux CI
Konflux CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up, so a local attacker with CI environment access can read them and gain repository access.
Konflux Konflux CI
An attacker with permission to trigger automated Konflux workflow runs can inject malicious filter commands through crafted issue titles, exposing API credentials, deployment keys, and internal notes in workflow logs.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog