Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-110879 FasterXML jackson-databind★CVE-2026-1928 Rank Math Rank Math SEO★CVE-2026-104350 Adobe Adobe Campaign Classic★CVE-2026-104351 Adobe Adobe Campaign Classic★CVE-2026-104353 Adobe Adobe Campaign Classic★CVE-2026-104354 Adobe Adobe Campaign Classic★CVE-2026-105489 Adobe Adobe Campaign Classic★CVE-2026-105779 Adobe Adobe Campaign Classic★CVE-2026-105780 Adobe Adobe Campaign Classic★CVE-2026-105781 Adobe Adobe Campaign ClassicPatch forecast · Oct 28
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 37 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
FasterXML jackson-databind
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, bypassing the fix for CVE-2026-54512 and allowing arbitrary class instantiation where polymorphic deserialization is exposed. CVSS 3.1 9.8.
Rank Math Rank Math SEO
The Rank Math SEO plugin for WordPress, in versions up to and including 1.0.276, deserializes untrusted input in the updateMeta REST API endpoint, so a contributor-level attacker can inject a PHP object and, through the chain in the record, write a webshell to the uploads directory. CVSS 3.1 8.8.
Adobe Adobe Campaign Classic
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain a reflected cross-site scripting flaw that can inject malicious scripts into a page a victim visits, potentially gaining elevated access or control over the victim's account or session, with scope changed. CVSS 3.1 9.3.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog