BestHub
Sign in
Tagged articles
52 articles
Page 1 of 1
Black & White Path
Black & White Path
May 12, 2026 · Information Security

16 CVEs Reveal Hidden Risks in Automotive Open‑Source Components

In May 2026, sixteen CVEs exposing vulnerabilities in small automotive open‑source libraries—covering CAN, UDS, ISO‑TP, and J1939—highlight how over‑trusted protocol fields, underestimated local boundaries, and neglected supply‑chain maintenance create a blind spot in vehicle security, prompting AI‑assisted research and concrete defensive recommendations.

AI securityCVESupply Chain
0 likes · 13 min read
16 CVEs Reveal Hidden Risks in Automotive Open‑Source Components
Black & White Path
Black & White Path
Apr 21, 2026 · Information Security

Anthropic MCP Protocol’s Design-Level Flaw Threatens Over 200K Servers – AI Supply‑Chain Alarm

A security report by OX Security reveals a systemic design flaw in Anthropic's Model Context Protocol (MCP) STDIO layer that enables command injection, whitelist bypass, zero‑click prompt attacks, and marketplace poisoning, affecting more than 200,000 servers and prompting urgent mitigation across the AI supply chain.

AI securityAnthropicCVE
0 likes · 11 min read
Anthropic MCP Protocol’s Design-Level Flaw Threatens Over 200K Servers – AI Supply‑Chain Alarm
Black & White Path
Black & White Path
Mar 20, 2026 · Information Security

Detect OpenClaw Security Gaps with the Open‑Source Dejavu Baseline Scanner

The article explains why OpenClaw’s autonomous AI‑agent architecture poses serious security risks—exposed ports, default‑off authentication, vulnerable skill plugins, and known CVEs—and presents a seven‑step manual baseline audit plus the open‑source Dejavu tool that automates these checks.

AI agentsCVEDejavu
0 likes · 16 min read
Detect OpenClaw Security Gaps with the Open‑Source Dejavu Baseline Scanner
Java Companion
Java Companion
Feb 24, 2026 · Backend Development

Spring Boot Online Dependency Vulnerability Scanner: One‑Click Detection of Potential Security Issues

This guide presents a lightweight Spring Boot dependency vulnerability scanner that automatically collects all project JARs, matches them against a CVE database, visualizes risk levels, provides detailed remediation steps and can be integrated into local development, emergency response, and CI/CD pipelines.

CVEDependency ScanningREST API
0 likes · 20 min read
Spring Boot Online Dependency Vulnerability Scanner: One‑Click Detection of Potential Security Issues
Black & White Path
Black & White Path
Feb 24, 2026 · Information Security

Common Privilege‑Escalation Vulnerabilities in Penetration Testing

This article systematically details the most frequently encountered privilege‑escalation flaws in penetration testing, covering Windows service misconfigurations, registry hijacking, kernel exploits, DLL hijacking, Linux SUID/SGID abuse, sudo misconfigurations, cron abuse, writable passwd files, and Docker escape techniques, along with step‑by‑step exploitation procedures and defensive recommendations.

CVELinuxSUID
0 likes · 29 min read
Common Privilege‑Escalation Vulnerabilities in Penetration Testing
DevOps Coach
DevOps Coach
Jan 14, 2026 · Information Security

What the First Linux Kernel Rust CVE Reveals About Memory Safety

The article explains CVE‑2025‑68260, the first Rust‑based vulnerability in the Linux kernel, detailing the race condition in the rust_binder driver, why the bug proves Rust’s safety promises, and how its limited impact contrasts with countless C‑related kernel CVEs.

CVELinux kernelMemory Safety
0 likes · 7 min read
What the First Linux Kernel Rust CVE Reveals About Memory Safety
Raymond Ops
Raymond Ops
Sep 19, 2025 · Information Security

How to Mitigate MySQL CVEs with iptables: Practical Firewall Rules

As network security threats rise, unpatchable MySQL vulnerabilities can be mitigated by configuring iptables rules that whitelist trusted IPs for port 3306 and drop all other traffic, with clear guidance on rule ordering and the differences between DROP and REJECT actions.

CVELinuxfirewall
0 likes · 7 min read
How to Mitigate MySQL CVEs with iptables: Practical Firewall Rules
Ops Development & AI Practice
Ops Development & AI Practice
Sep 4, 2025 · Information Security

Mapping Vulnerabilities: From CVE IDs to NVD, GitHub Advisory & Vendor Notices

This article explains how CVE identifiers serve as a universal naming system for vulnerabilities and compares the roles of NVD, GitHub Advisory Database, and vendor security advisories, showing how to combine these sources into a layered intelligence network for effective risk assessment and remediation.

CVEGitHub AdvisoryInformation Security
0 likes · 8 min read
Mapping Vulnerabilities: From CVE IDs to NVD, GitHub Advisory & Vendor Notices
MaGe Linux Operations
MaGe Linux Operations
Jun 1, 2025 · Information Security

Patch MySQL Vulnerabilities with iptables Firewall Rules

This guide explains how to mitigate several MySQL-related security flaws—such as CVE-2022-32221, CVE-2023-21912, and CVE-2022-37434—by configuring iptables rules to restrict traffic, illustrating command usage, rule ordering, and the differences between DROP and REJECT actions.

CVEfirewalliptables
0 likes · 6 min read
Patch MySQL Vulnerabilities with iptables Firewall Rules
Aikesheng Open Source Community
Aikesheng Open Source Community
May 26, 2025 · Information Security

Building a Minimal Offline MySQL CVE Scanning Tool with DuckDB

This article demonstrates how to create a lightweight, offline MySQL CVE scanning and reporting tool by cloning the CVEProject JSON repository, leveraging DuckDB for fast JSON parsing and SQL queries, and providing simple shell commands for data updates, version scanning, and vulnerability matching.

CVEDuckDBShellScript
0 likes · 6 min read
Building a Minimal Offline MySQL CVE Scanning Tool with DuckDB
Liangxu Linux
Liangxu Linux
May 6, 2025 · Information Security

How to Mitigate MySQL Vulnerabilities with iptables Rules

This guide explains how to use Linux iptables to block or allow traffic to MySQL's port 3306, providing a practical workaround for several high‑severity CVE‑listed MySQL vulnerabilities that cannot be patched by upgrading in production environments.

CVEiptablesmysql
0 likes · 6 min read
How to Mitigate MySQL Vulnerabilities with iptables Rules
Alibaba Cloud Native
Alibaba Cloud Native
Apr 4, 2025 · Information Security

Why Ingress Nginx’s Architecture Turns Security Into a Nightmare – 5 New Critical CVEs Explained

A recent security research reveals five critical CVEs in the Kubernetes Ingress Nginx controller caused by a combined control‑plane and data‑plane design, exposing clusters to unauthenticated remote code execution, while also highlighting stability and operational challenges that motivate alternative cloud‑native ingress solutions.

CVEIngressNginx
0 likes · 12 min read
Why Ingress Nginx’s Architecture Turns Security Into a Nightmare – 5 New Critical CVEs Explained
Tencent Technical Engineering
Tencent Technical Engineering
Mar 5, 2025 · Information Security

Detecting Critical AI Infrastructure Vulnerabilities with AI-Infra-Guard

As open‑source large language model tools like Ollama, OpenWebUI and ComfyUI gain popularity, numerous security flaws such as unauthenticated APIs, CVE‑exploits, model theft and remote code execution emerge, prompting the development of AI‑Infra‑Guard—a lightweight, cross‑platform scanner that identifies over 30 component vulnerabilities and offers both web UI and CLI modes for rapid risk assessment.

AI securityAI-Infra-GuardCVE
0 likes · 13 min read
Detecting Critical AI Infrastructure Vulnerabilities with AI-Infra-Guard
MaGe Linux Operations
MaGe Linux Operations
Jan 24, 2025 · Information Security

How to Secure Docker Images with Trivy: Step-by-Step Guide

This guide explains how to set up Docker on Ubuntu 18.04, install and configure the Trivy vulnerability scanner, and use it to analyze container images such as Redis, BusyBox, and Nginx, covering database updates, output formats, and practical command examples.

CVEContainer SecurityDocker
0 likes · 9 min read
How to Secure Docker Images with Trivy: Step-by-Step Guide
Java Tech Enthusiast
Java Tech Enthusiast
Sep 4, 2024 · Information Security

Spring and Nacos Security Vulnerabilities and Mitigation Guide

Recent disclosures revealed critical Spring DoS flaws (CVE‑2024‑38809 and CVE‑2024‑38808) exploitable via oversized If‑Match/If‑None‑Match headers and malicious SpEL expressions, plus a Nacos 2.4.1 vulnerability allowing arbitrary file read/write through port 7848, mitigated by upgrading to the patched Spring and Nacos releases or restricting the vulnerable ports.

CVENacosVulnerability
0 likes · 7 min read
Spring and Nacos Security Vulnerabilities and Mitigation Guide
Java Tech Enthusiast
Java Tech Enthusiast
Mar 14, 2024 · Information Security

VM Escape via Chrome and VMware: Six‑CVE Attack Chain

A Korean security firm demonstrated a real‑world VM‑escape chain in which a user clicking a malicious Chrome link inside a VMware guest triggers six linked CVEs—two Chrome sandbox bypasses, two Windows kernel driver flaws, a VM‑information leak, and a Bluetooth buffer overflow—ultimately granting the attacker host‑level code execution and full system compromise.

CVEChromeVM Escape
0 likes · 5 min read
VM Escape via Chrome and VMware: Six‑CVE Attack Chain
OPPO Amber Lab
OPPO Amber Lab
Jan 19, 2024 · Information Security

Uncovering Android AIDL/HIDL Service Vulnerabilities: Methods and Real CVE Examples

This article explains how Android AIDL and HIDL services are generated, outlines systematic steps to enumerate services, filter Java implementations, and automate information gathering, then details common memory‑corruption bug patterns and demonstrates real CVE‑2023‑21008 and CVE‑2023‑20766 exploits, concluding with a risk assessment.

AIDLAndroidCVE
0 likes · 9 min read
Uncovering Android AIDL/HIDL Service Vulnerabilities: Methods and Real CVE Examples
Sohu Tech Products
Sohu Tech Products
Dec 20, 2023 · Information Security

Command Injection Vulnerabilities in Node.js: Analysis and Prevention

The article examines how command‑injection flaws in popular Node.js npm packages such as find‑exec and fs‑git arise from unsafe concatenation of user input into shell commands, and recommends rigorous validation, using execFile or spawn, and regular dependency audits to prevent catastrophic system compromise.

CVECommand InjectionSecure Coding
0 likes · 11 min read
Command Injection Vulnerabilities in Node.js: Analysis and Prevention
OPPO Amber Lab
OPPO Amber Lab
Nov 30, 2023 · Information Security

Uncovering Android Socket Service Vulnerabilities: Techniques and Case Study

This article details the methodology for discovering and analyzing Android local socket service vulnerabilities, outlines prerequisite skills, explains service classifications, demonstrates data‑handling function tracing, and presents a CVE‑2023‑35694 case study, highlighting common flaw types and mitigation insights.

AndroidCVESocket
0 likes · 8 min read
Uncovering Android Socket Service Vulnerabilities: Techniques and Case Study
IT Services Circle
IT Services Circle
Sep 8, 2023 · Information Security

High‑Severity Vulnerabilities Discovered in Notepad++ (CVE‑2023‑40031, CVE‑2023‑40036, CVE‑2023‑40164, CVE‑2023‑40166)

Security researchers have identified four high‑severity buffer‑overflow vulnerabilities (CVE‑2023‑40031, CVE‑2023‑40036, CVE‑2023‑40164, CVE‑2023‑40166) in the popular open‑source editor Notepad++, disclosed after the developers failed to patch them before the release of version 8.5.6, urging users to apply mitigations.

CVEInformation SecurityNotepad++
0 likes · 3 min read
High‑Severity Vulnerabilities Discovered in Notepad++ (CVE‑2023‑40031, CVE‑2023‑40036, CVE‑2023‑40164, CVE‑2023‑40166)
AntTech
AntTech
Aug 31, 2023 · Information Security

In-Depth Analysis of Apple UserFS Architecture, Control Flow, and Vulnerabilities

This article provides a comprehensive examination of Apple’s UserFS, detailing its architecture, mounting and file‑access control flows, exposing three real vulnerabilities (CVE‑2022‑42861, CVE‑2022‑42842, a kernel UAF) and discussing how UserFS reshapes the iOS file‑system security model.

AppleCVEUserFS
0 likes · 14 min read
In-Depth Analysis of Apple UserFS Architecture, Control Flow, and Vulnerabilities
Java Architecture Diary
Java Architecture Diary
Jul 25, 2023 · Backend Development

Fixing Spring Boot Startup Errors After CVE‑2023‑34035 Upgrade

When upgrading Spring Boot to patch CVE‑2023‑34034 and CVE‑2023‑34035, applications using Spring Security may encounter a startup error indicating ambiguous pattern detection, which can be resolved by upgrading to patched versions and adjusting requestMatchers to use MvcRequestMatcher or AntPathRequestMatcher as appropriate.

AuthorizationCVESpring Boot
0 likes · 4 min read
Fixing Spring Boot Startup Errors After CVE‑2023‑34035 Upgrade
Laravel Tech Community
Laravel Tech Community
May 4, 2023 · Information Security

Go 1.20.4 and 1.19.9 Release: Security Fixes in html/template

The Go 1.20.4 and 1.19.9 releases address three critical security vulnerabilities in the html/template package, including improper handling of CSS values, JavaScript whitespace, and HTML empty attributes, which could lead to unintended HTML injection and attribute manipulation.

CVEGoHTML template
0 likes · 2 min read
Go 1.20.4 and 1.19.9 Release: Security Fixes in html/template
MaGe Linux Operations
MaGe Linux Operations
Mar 19, 2023 · Information Security

How a 23‑Year‑Old Curl Bug Exposed Cookie Security Flaws

The article recounts the 23.9‑year‑long curl vulnerability discovered by Daniel Stenberg, detailing the early implementation of cookie handling, the challenges of dual cookie syntax, the security bug involving control‑code cookies, and the eventual fix released after nearly nine thousand days.

CVECookieHTTP
0 likes · 10 min read
How a 23‑Year‑Old Curl Bug Exposed Cookie Security Flaws
Laravel Tech Community
Laravel Tech Community
Nov 24, 2022 · Information Security

Comprehensive phpMyAdmin Vulnerability Exploitation Guide

This article provides an extensive overview of phpMyAdmin security weaknesses, detailing information‑gathering techniques, version detection, path discovery, multiple exploitation methods such as file writes, log manipulation, slow‑query abuse, user‑defined functions, MOF attacks, and step‑by‑step PoCs for numerous CVEs, all illustrated with concrete SQL and script examples.

CVEExploitationSQL injection
0 likes · 19 min read
Comprehensive phpMyAdmin Vulnerability Exploitation Guide
Open Source Linux
Open Source Linux
Oct 23, 2022 · Information Security

How a 23‑Year‑Old Curl Cookie Bug Evaded Detection Until 2022

This article recounts the 23.9‑year lifespan of a curl cookie handling vulnerability, tracing its origins in 1998, the evolution of cookie specifications, the discovery of the CVE‑2022‑35252 bug, and the eventual fix that finally eliminated the flaw after nearly 9,000 days.

CVECookieHTTP
0 likes · 9 min read
How a 23‑Year‑Old Curl Cookie Bug Evaded Detection Until 2022
MaGe Linux Operations
MaGe Linux Operations
Oct 18, 2022 · Information Security

How a 23‑Year‑Old Curl Cookie Bug Evaded Detection Until 2022

The article recounts the 23.9‑year‑long history of a curl cookie handling vulnerability, explains how ambiguous cookie specifications caused a dual‑syntax challenge, describes the CVE‑2022‑35252 bug and its simple fix, and reflects on the broader implications for HTTP security.

CVECookieHTTP
0 likes · 9 min read
How a 23‑Year‑Old Curl Cookie Bug Evaded Detection Until 2022
AntTech
AntTech
Oct 11, 2022 · Information Security

In‑Depth Analysis of Hyper‑V DirectX Attack Surface and Related CVEs

The article provides a comprehensive technical walkthrough of the Hyper‑V DirectX component, detailing its architecture, virtual GPU configuration, attack surface, and step‑by‑step exploitation of four critical CVEs (CVE‑2022‑21918, CVE‑2021‑43219, CVE‑2022‑21912, CVE‑2022‑21898) with code snippets and debugging insights.

CVEDirectXHyper-V
0 likes · 11 min read
In‑Depth Analysis of Hyper‑V DirectX Attack Surface and Related CVEs
OPPO Kernel Craftsman
OPPO Kernel Craftsman
Sep 30, 2022 · Information Security

Analysis of Android Bluetooth Protocol Stack Vulnerabilities (CVE-2020-27024, CVE-2021-0918, CVE-2021-39805)

The article examines three Android Bluetooth stack flaws—CVE‑2020‑27024 in the SMP pairing protocol, CVE‑2021‑0918 in GATT notifications, and CVE‑2021‑39805 in L2CAP signaling—detailing their out‑of‑bounds memory errors, underlying code issues, and implications for future Rust‑based stack security.

AndroidBluetoothCVE
0 likes · 15 min read
Analysis of Android Bluetooth Protocol Stack Vulnerabilities (CVE-2020-27024, CVE-2021-0918, CVE-2021-39805)
Alibaba Cloud Native
Alibaba Cloud Native
Jul 21, 2022 · Information Security

Why Ingress Nginx’s Architecture Exposes Critical Vulnerabilities and How MSE Cloud‑Native Gateway Secures Them

The article analyzes three recent high‑severity CVEs in the Kubernetes Ingress Nginx project, explains how its combined control‑plane and data‑plane design creates serious security and stability risks, and demonstrates how the MSE cloud‑native gateway’s separated architecture and xDS‑based configuration provide a safer, more reliable alternative.

CVECloud NativeKubernetes
0 likes · 10 min read
Why Ingress Nginx’s Architecture Exposes Critical Vulnerabilities and How MSE Cloud‑Native Gateway Secures Them
OPPO Amber Lab
OPPO Amber Lab
Jun 29, 2022 · Information Security

Inside Android Bluetooth: Three Critical CVEs and Their Exploits

This article examines the complexity of the Bluetooth protocol stack, focusing on Android’s Host layer vulnerabilities, and provides detailed analyses of three critical CVEs—CVE‑2020‑27024 (SMP), CVE‑2021‑0918 (GATT), and CVE‑2021‑39805 (L2CAP)—including protocol overviews, code excerpts, and exploitation paths.

AndroidBluetoothCVE
0 likes · 13 min read
Inside Android Bluetooth: Three Critical CVEs and Their Exploits
Code Ape Tech Column
Code Ape Tech Column
Mar 5, 2022 · Information Security

Spring Cloud Gateway Vulnerabilities CVE-2022-22946 and CVE-2022-22947: Description, Impact, and Mitigation

This article explains two critical Spring Cloud Gateway vulnerabilities (CVE-2022-22946 and CVE-2022-22947), detailing their causes, affected versions, potential impact, and recommended remediation steps such as upgrading to safe releases or disabling the vulnerable actuator endpoint.

CVERemote Code ExecutionSecurity Patch
0 likes · 4 min read
Spring Cloud Gateway Vulnerabilities CVE-2022-22946 and CVE-2022-22947: Description, Impact, and Mitigation
Programmer DD
Programmer DD
Mar 2, 2022 · Information Security

Critical Spring Cloud Gateway Vulnerabilities and How to Mitigate Them

The article outlines two Spring Cloud Gateway CVEs—CVE-2022-22947 (critical code injection) and CVE-2022-22946 (medium HTTP/2 TrustManager issue)—detailing their severity, affected versions, and recommended mitigation steps such as upgrading to 3.1.1+, disabling Actuator, or securing it with Spring Security.

CVECode InjectionHTTP2
0 likes · 4 min read
Critical Spring Cloud Gateway Vulnerabilities and How to Mitigate Them
OPPO Amber Lab
OPPO Amber Lab
Nov 19, 2021 · Information Security

How Android 11’s New Features Opened Up Three Critical Security Holes

This article examines three Android 11 security vulnerabilities—CVE‑2021‑0485’s picture‑in‑picture resizing flaw, CVE‑2021‑0521’s unprotected package‑visibility API, and CVE‑2021‑0645’s storage‑access bypass—detailing their causes, code examples, and the patches Google released to mitigate them in practice.

AndroidAndroid 11CVE
0 likes · 7 min read
How Android 11’s New Features Opened Up Three Critical Security Holes
Liangxu Linux
Liangxu Linux
Mar 13, 2021 · Information Security

How Hackers Break Into the OS Kernel: Methods, Exploits, and Defenses

This article explains how attackers gain kernel-level privileges by exploiting vulnerabilities such as null-pointer dereferences, use-after-free, and integer overflow bugs, outlines the four legitimate ways programs enter kernel mode, and reviews real-world CVE cases and modern mitigation techniques.

CVEOS securityUse-After-Free
0 likes · 10 min read
How Hackers Break Into the OS Kernel: Methods, Exploits, and Defenses
Liangxu Linux
Liangxu Linux
Jan 18, 2021 · Information Security

Escaping VMware: The Story Behind a VM Escape Exploit and Anti‑VM Tricks

A vivid narrative follows two hackers who discover they are inside a VMware virtual machine, exploit a CVE‑2017‑4901 backdoor heap overflow to escape, only to realize they have entered another VM, while the article also explains virtualization detection techniques and anti‑VM methods.

Anti-VMCVEVM Escape
0 likes · 9 min read
Escaping VMware: The Story Behind a VM Escape Exploit and Anti‑VM Tricks
Programmer DD
Programmer DD
Jan 16, 2021 · Information Security

Bypassing Nacos 1.4.1 User-Agent Authentication to Add Arbitrary Users

The article explains how Nacos 1.4.1's serverIdentity key‑value authentication can be bypassed by manipulating the request path, allowing attackers to call any HTTP interface, add new users, and gain full console access, and provides reproduction steps and a fix recommendation.

Authentication BypassCVENacos
0 likes · 10 min read
Bypassing Nacos 1.4.1 User-Agent Authentication to Add Arbitrary Users
21CTO
21CTO
Nov 19, 2020 · Information Security

How to Exploit and Patch Ubuntu’s Silent Sudo User Vulnerability

This article explains a critical Ubuntu flaw that lets a standard user create a new sudo account and gain root privileges without a system password, details the step‑by‑step exploitation process, and outlines the official patches released to fix the issue.

CVEExploitLinux security
0 likes · 6 min read
How to Exploit and Patch Ubuntu’s Silent Sudo User Vulnerability
Programmer DD
Programmer DD
Nov 12, 2020 · Information Security

Uncovering MySQL Exploits: From File Reads to Remote Code Execution

This article provides a comprehensive overview of common MySQL attack techniques—including client‑side arbitrary file reads, SSRF‑based data extraction, server‑side file read/write, remote code execution vulnerabilities (CVE‑2016‑6662), and authentication bypass (CVE‑2012‑2122)—and supplies practical command examples and mitigation insights.

CVEDatabase SecurityExploitation
0 likes · 14 min read
Uncovering MySQL Exploits: From File Reads to Remote Code Execution
Laravel Tech Community
Laravel Tech Community
Aug 11, 2020 · Backend Development

Apache HTTP Server 2.4.46 Released with Security Fixes and Enhancements

Apache HTTP Server 2.4.46 has been released, addressing several security vulnerabilities (including CVE‑2020‑11984 and CVE‑2020‑11993), fixing bugs, and adding enhancements such as improved module compatibility and requirements for APR libraries, while urging users to migrate from the deprecated 2.2 branch.

ApacheCVEHTTP server
0 likes · 3 min read
Apache HTTP Server 2.4.46 Released with Security Fixes and Enhancements
Programmer DD
Programmer DD
May 30, 2020 · Information Security

Critical Fastjson RCE Vulnerability (≤1.2.68): Risks, Impact, and Fixes

On May 28, 2020, 360CERT reported a high‑severity remote code execution flaw in Alibaba’s Fastjson library (versions ≤1.2.68) that bypasses autotype restrictions, affecting many assets, and provided temporary mitigation steps and upgrade recommendations to safeguard systems.

CVERemote Code ExecutionSecurity Advisory
0 likes · 3 min read
Critical Fastjson RCE Vulnerability (≤1.2.68): Risks, Impact, and Fixes
360 Tech Engineering
360 Tech Engineering
Jun 21, 2019 · Information Security

A Comprehensive Guide to Office 0‑day/1‑day Vulnerabilities (2010‑2018)

This article expands on the author's BlueHat Shanghai 2019 presentation, summarizing Office‑related 0‑day and 1‑day vulnerabilities discovered between 2010 and 2018, categorizing them by component and type, and providing extensive references, analysis notes, and exploitation guidance for security researchers.

0dayCVEExploit
0 likes · 25 min read
A Comprehensive Guide to Office 0‑day/1‑day Vulnerabilities (2010‑2018)
Alibaba Cloud Native
Alibaba Cloud Native
Jun 10, 2019 · Information Security

Critical Docker & Kubernetes Vulnerabilities and Key Open‑Source Updates You Must Know

This week’s roundup covers two high‑severity Docker CVEs (CVE‑2019‑5021 privilege escalation in Alpine images and CVE‑2018‑15664 TOCTOU flaw in docker cp), Kubernetes moving to Go modules, new Envoy request‑mirror and route‑debug features, Knative’s stateful‑serverless experiment, Istio 1.0 EOL, Cilium’s BPF‑based network policy, and emerging Service Mesh trends, all with reference links for deeper reading.

CVEDockerKubernetes
0 likes · 10 min read
Critical Docker & Kubernetes Vulnerabilities and Key Open‑Source Updates You Must Know
21CTO
21CTO
Feb 7, 2019 · Information Security

How the 'SpeakUp' Linux Backdoor Hijacks Servers and Mines Monero

A newly discovered Linux backdoor called SpeakUp, exploiting the ThinkPHP CVE‑2018‑20062 flaw, spreads via a built‑in Python script, hijacks cron for persistence, leverages multiple CVEs to compromise servers, and mines Monero, with infections concentrated in China and South America.

CVELinuxThinkPHP
0 likes · 4 min read
How the 'SpeakUp' Linux Backdoor Hijacks Servers and Mines Monero
Node Underground
Node Underground
Sep 29, 2016 · Information Security

What Critical Security Fixes Did Node.js Release on Sep 28?

On September 28 Node.js issued four security updates—including maintenance releases 0.10.47 and 0.12.16, LTS 4.6.0 Argon, and stable 6.7.0—addressing multiple CVEs such as wildcard certificate validation, HTTP header validation, OCSP extension misuse, and the SWEET32 attack, and urging users to upgrade promptly.

CVEInformation SecurityNode.js
0 likes · 3 min read
What Critical Security Fixes Did Node.js Release on Sep 28?