Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-109237 Crawl4AI Crawl4AI★CVE-2026-109238 Crawl4AI Crawl4AI★CVE-2026-109286 Open WebUI Open WebUI★CVE-2026-109305 Craft CMS Craft CMS★CVE-2026-109308 Craft CMS Craft CMS★CVE-2026-109357 LibreNMS LibreNMS★CVE-2026-109371 ZITADEL ZITADEL★CVE-2026-109373 ZITADEL ZITADEL★CVE-2026-87744 Red Hat Quarkus REST Data Panache★CVE-2026-96012 IBM Db2 Mirror for iPatch forecast · Oct 12
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 57 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
Crawl4AI Crawl4AI
Non-admin Crawl4AI API clients can wrap forbidden configuration objects in dictionary wrappers to defeat the untrusted-config gate, read the server SECRET_KEY and provider keys through the config dump, and forge admin tokens. Fixed in 0.9.4.
Crawl4AI Crawl4AI
Unauthenticated Crawl4AI API clients can enable link preview on crawl requests so the URL seeder fetches internal, private, and cloud metadata links from a controlled page and returns their parsed head data. Fixed in 0.9.4.
Open WebUI Open WebUI
Any website can post unvalidated messages to Open WebUI's SyncStatsModal, redirect an authenticated stats export to the authentication endpoint with a traversal chat id, and receive the signed-in user's JWT for full API access. Fixed in 0.11.4.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog