Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-116843 Mistral AI Mistral Vibe★CVE-2026-18450 Supermicro BMC firmware★CVE-2026-65220 Supermicro BMC firmware★CVE-2026-75891 Themeum Kirki★CVE-2026-112346 OpenHands Software Agent SDK★CVE-2026-116149 ImageMagick ImageMagick★CVE-2026-116163 Parse Server Parse Server★CVE-2026-116176 vLLM vLLM★CVE-2026-116191 rclone rclone★CVE-2026-116199 Snipe-IT Snipe-ITPatch forecast · Oct 27
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 28 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
Mistral AI Mistral Vibe
Mistral Vibe before 3.0.3 runs git filter drivers defined in an untrusted repository's own configuration when creating a worktree, before the trusted-folder check, so opening a crafted repository with --worktree executes attacker commands with the user's privileges. CVSS 3.1 8.8.
Supermicro BMC firmware
Supermicro BMC firmware does not correctly enforce integrity and encryption requirements for IPMI commands, so an attacker who can reach the BMC may craft packets that execute arbitrary commands on an active RMCP+ session. The vendor rates it critical at CVSS 3.1 9.8 and lists per-model fixed BMC firmware for 402 motherboard SKUs.
Supermicro BMC firmware
A logic flaw in Supermicro BMC IPMI handling lets an attacker with a low-privilege account send specially crafted RAKP+ messages and escalate that account to administrator privileges on the BMC. The vendor rates it high at CVSS 3.1 8.8 and lists per-model fixed BMC firmware for 402 motherboard SKUs.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog