Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-105453 IBM IBM Sterling Connect:Direct for Unix★CVE-2026-107366 IBM IBM Langflow OSS★CVE-2026-107400 IBM IBM TRIRIGA Application Platform★CVE-2026-109126 IBM IBM Verify Identity Access★CVE-2026-10572 IBM IBM MQ★CVE-2026-10574 IBM IBM MQ★CVE-2026-10743 IBM IBM MQ★CVE-2026-111862 Rank Math Rank Math SEO PRO★CVE-2026-112770 Craft CMS Craft CMS★CVE-2026-112772 Craft CMS Craft CMSPatch forecast · Oct 20
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 106 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
IBM IBM Sterling Connect:Direct for Unix
IBM Sterling Connect:Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management. CVSS 3.1 8.4.
IBM IBM Langflow OSS
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification, so any authenticated user can delete another user's messages, overwrite message content, or hijack a session. CVSS 3.1 8.3.
IBM IBM TRIRIGA Application Platform
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. CVSS 3.1 8.8.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog