Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-109618 PHP Group PHP★CVE-2026-109619 PHP Group PHP★CVE-2026-114045 FreeRDP FreeRDP★CVE-2026-114053 vLLM vLLM★CVE-2026-114094 Dulwich Dulwich★CVE-2026-114109 Astral uv★CVE-2026-114403 PHPOffice PHPPresentation★CVE-2026-20043 Cisco Snort 3★CVE-2026-76473 Cisco Cisco Unified Communications Manager★CVE-2026-76474 Cisco Cisco Unified Communications ManagerPatch forecast · Oct 21
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 100 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
PHP Group PHP
PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 uses longjmp for out-of-memory errors in contexts that can leave request memory uninitialized, so request cleanup can read or branch on that memory and multiple out-of-memory strategies can give unauthenticated remote code execution. CVSS 3.1 9.8.
PHP Group PHP
PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 can leave global state pointing into freed request memory when a reset is missed or state is repopulated after reset, so a later request on the same worker can act on stale state before initialization and give remote code execution. CVSS 3.1 9.8.
FreeRDP FreeRDP
FreeRDP before 3.32.1 has a heap-based buffer overflow in the server-side rdpsnd channel: an integer wraparound in block-alignment arithmetic bypasses validation, so a malicious RDP client can cause an unbounded heap write during server audio playback. CVSS 3.1 8.8.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog