Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-123543 OpenIdentityPlatform OpenAM★CVE-2026-123549 OpenIdentityPlatform OpenAM★CVE-2026-123550 OpenIdentityPlatform OpenAM★CVE-2026-123551 OpenIdentityPlatform OpenAM★CVE-2026-123562 sveltejs devalue★CVE-2026-123570 hickory-dns Hickory DNS★CVE-2026-123580 hickory-dns Hickory DNS★CVE-2026-123595 hickory-dns Hickory DNS★CVE-2026-123605 hickory-dns Hickory DNS★CVE-2026-123614 imgproxy imgproxyPatch forecast · Nov 8
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 66 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
OpenIdentityPlatform OpenAM
OpenAM before 16.1.4 lets unauthenticated attackers exhaust server resources by sending serialized Java data without size or structure limits to remote SDK endpoints, classic login pages, or the administration console, rated high at CVSS 8.7 under version 4.0; fixed in 16.1.4.
OpenIdentityPlatform OpenAM
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, letting anonymous attackers set restricted attributes including group membership and join administrative groups, rated critical at CVSS 9.8; fixed in 16.1.4.
OpenIdentityPlatform OpenAM
OpenAM before 16.1.4 accepts unsigned SAML assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false, letting unauthenticated attackers forge assertions and obtain sessions as any mapped user including administrators, rated critical at CVSS 9.8; fixed in 16.1.4.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog