Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-16487 Red Hat bootc★CVE-2026-111880 FreeRDP FreeRDP★CVE-2026-111882 phpMyFAQ phpMyFAQ★CVE-2026-111884 phpMyFAQ phpMyFAQ★CVE-2026-111901 phpMyFAQ phpMyFAQ★CVE-2026-111908 phpMyFAQ phpMyFAQ★CVE-2026-111909 phpMyFAQ phpMyFAQ★CVE-2026-111911 phpMyFAQ phpMyFAQ★CVE-2026-111923 fleetdm Fleet★CVE-2026-111924 fleetdm FleetPatch forecast · Oct 19
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 107 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
Red Hat bootc
Red Hat says bootc hosts using the default containers signature policy can apply unsigned content when a mutable image tag is updated, letting an attacker who can update that tag place arbitrary OS content that runs as the host root filesystem on reboot. CVSS 3.1 8.1.
FreeRDP FreeRDP
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path, which does not validate the MIC offset in a crafted AUTHENTICATE_MESSAGE. CVSS 4.0 8.3 (CVSS 3.1 7.4).
phpMyFAQ phpMyFAQ
phpMyFAQ from 3.2.0-alpha before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks, including on administrator accounts. CVSS 3.1 8.1.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog