Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-107360 Red Hat Red Hat Satellite 6★CVE-2026-127056 PapaParse PapaParse★CVE-2026-127111 Alinto SOGo★CVE-2026-127131 Alinto SOGo★CVE-2026-127204 wp.insider WooCommerce PayPal Pro Payment Gateway★CVE-2026-127208 datamodel-code-generator datamodel-code-generator★CVE-2026-13672 Synology DiskStation Manager (DSM)★CVE-2026-18596 Synology DiskStation Manager (DSM)★CVE-2026-18792 Synology DiskStation Manager (DSM)★CVE-2026-19048 Synology DiskStation Manager (DSM)Patch forecast · Nov 12
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 81 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
Red Hat Red Hat Satellite 6
A flaw in rubygem-safemode lets an authenticated attacker who can supply template content bypass the Jail allow-list and invoke arbitrary methods on objects exposed to the template renderer, including host deletion. Red Hat rates it critical at CVSS 9.6.
PapaParse PapaParse
PapaParse before 5.7.1 lets a remote unauthenticated attacker exhaust CPU by submitting delimiter-free quoted CSV input, blocking the Node.js event loop or freezing a browser tab. NVD rates it high at CVSS 4.0 8.7.
Alinto SOGo
SOGo before 5.12.13 lets an unauthenticated attacker guess secret-question answers without lockout, obtain a password-recovery token, and take over accounts. NVD rates it critical at CVSS 9.1.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog