home.social

Search

12 results for “kev_johnson”

  1. Cooper @ministraitor

    KEV Is Not One List - Cédric Bonhomme
    @hack_lu
    youtu.be/Kk9Qe6d_t1s

    #hacklu #lightningtalk
  2. ssvc @ssvc

    CVE-2026-110447 (9.2 critical) Collabora Online – Built-in CODE Server OS Command Injection Vulnerability was just added to the CISA KEV Catalog. TGIF

    #cisa #kev #collaboraonline
  3. ssvc @ssvc

    So when CISA adds another CVE to the KEV Catalog later in the day, how should they handle it? 👀 They already published a "CISA adds one known exploited vulnerability to the Catalog" today, should they create a redirect to the new blog post?

  4. ssvc @ssvc

    Placeholder for CISA blog post: cisa.gov/news-events/alerts/20

    #cisa #kev #arista
  5. CyberWorldOps @cyberworldops

    CISA added actively exploited critical vulnerabilities in Collabora Online and Arista VeloCloud to the KEV catalog. The flaws expose Nextcloud collaboration environments and SD-WAN deployments to potential compromise. Federal systems face mandatory remediation deadlines, private sector patching is strongly advised.

    cyberworldops.eu/en/exploited-

    #cisakev #collaboraonline #velocloud
  6. LA LUTZ CINEMA @[email protected]

    **La Maison de nos rêves**
    De: Claude Zidi Jr.
    Avec: Kev Adams, Chantal Ladesou, Camille Aguilar, Bernard Farcy

    Samedi 24 octobre : 21H00 VF
    Dimanche 25 octobre : 15H00 VF
    Mardi 27 octobre : 21H00 VF

    Plus d'infos et réservations sur notre site : peyrehorade-cinema.fr
    #cinéma #peyrehorade #LaLutz #LaMaisondenosreves #Jr #Adams-Kev #Ladesou-Chantal #Aguilar-Camille #Farcy-Bernard

    #cinema #peyrehorade #lalutz #lamaisondenosreves #jr #adams
  7. ZEN SecDB @secdb

    🚨 [CISA-2026:1023] CISA Adds One Known Exploited Vulnerability to Catalog (secdb.nttzen.cloud/security-ad)

    CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    ⚠️ CVE-2026-114625 (secdb.nttzen.cloud/cve/detail/)
    - Name: Arista VeloCloud Orchestrator SQL Injection Vulnerability
    - Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    - Known To Be Used in Ransomware Campaigns? Unknown
    - Vendor: Arista
    - Product: VeloCloud Orchestrator
    - Notes: arista.com/en/support/advisori ; ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

    #zen #secdb #infosec #cve #cisa_kev #cisa_20261023
  8. Dev Community @[email protected]

    Detecting CVE-2026-96655 exploitation in Plex logs


    Patching Plex Media Server to 1.43.3.10861 removes the SSRF described in CVE-2026-96655. It does not tell you whether someone already used it. That question is answerable, but only if you know what the server records.

    The flaw lets an authenticated user supply a path parameter to /video/:/transcode/universal that the server then fetches on their behalf. Detection therefore rests on three observables: who called the endpoint, what target they nominated, and what the server did with the response.

    Observable one: the request itself


    Plex Media Server logs transcoder activity. Requests to the universal transcoder endpoint appear with client identity and session context. In a normal household, calls to that endpoint come from a small set of device identities at predictable hours.

    The signal is not "the endpoint was called". It is "the endpoint was called by an identity that normally only browses", or "the endpoint was called with an unusual parameter shape". Build a baseline from a quiet week, then review deviations. Any review that starts after detecting a compromise has no baseline, which is why this step belongs in routine work.

    Observable two: outbound destinations


    The stronger signal lives outside the application log. A Plex server that suddenly opens connections to loopback administrative ports, to a router management interface, or to a link-local metadata address is doing something a media server has no reason to do.

    If you have flow logs from a firewall, a router, or a cloud VPC, query for traffic originating from the Plex host toward internal management subnets. Plex fetches artwork, subtitles and metadata from the internet; it does not legitimately talk to 169.254.169.254 or to your hypervisor console.

    On a single host without flow telemetry, host-level tooling can fill the gap. Connection auditing or a short-lived packet capture on the media server's interface will show the second hop within minutes of a test request.

    Observable three: response handling anomalies


    A forged request that succeeds returns content the transcoder did not expect. That frequently produces parse errors, unusual media probe failures, or transcode sessions that start and immediately stop. Spikes in transcode failures with no corresponding client complaint are worth a look.

    This is a weak signal on its own, and it should not be treated as evidence. It is a triage prompt, not a conclusion.

    Building the query


    The remediation guidance from CISA sets a federal due date of 3 November 2026 under BOD 26-04, and organisations that follow KEV-driven prioritisation can reuse the same timeline. A useful internal ticket contains a list of hosts running 1.43.2 or earlier, a pointer to the log fields above, and an explicit statement of what "no evidence of exploitation" means in your environment.

    The ZoomEye product query app="Plex Media Server" returns 507,974 matching assets, which is a reminder of how many servers exist outside any inventory you control. The vul.cve="CVE-2026-96655" query returns zero, meaning asset-level attribution for this CVE is not yet indexed. Absence of indexed vulnerable hosts is not absence of vulnerable hosts.

    If you find something


    Preserve the log segment and the connection records before rotating anything. Identify the account that made the request and disable it. Check what the forged requests reached: a response from a router admin page is different from a response from a metadata service that returned credentials. Rotate any credential or token the target could have disclosed. Then patch, because containment without the upgrade leaves the capability in place.

    A detection rule that never fires is not proof of safety. It is a reason to keep the rule running while the patch rolls out.

    References


    • Plex security advisory for Media Server 1.43.2 and earlier
    • CISA Known Exploited Vulnerabilities entry for CVE-2026-96655
    • CISA BOD 26-04 prioritising security updates based on risk
    • NVD record for CVE-2026-96655


    #vulnerability #cve202696655 #plex #ssrf #software #coding #development #engineering #inclusive #community
    Detecting CVE-2026-96655 exploitation in Plex logs

    #cve202696655 #ssrf #plex #inclusive #engineering #development
  9. Kev Quirk @kev

    Hooman. I believe it is dinner time.

    kevquirk.com/2026-10-24-1947

  10. Kev Quirk @kev

    I've decided to revert the Fediverse integration I wrote into Pure Comments.

    kevquirk.com/pure-comments-and

  11. Kev Quirk @kev

    I've never really tracked my effort very well, so I decided to create a page to help me track it. Turns out I've completed the challenge 7 times!

    kevquirk.com/100

    kevquirk.com/2026-10-23-1156

    #100daystooffload
  12. Kev Quirk @kev

    So. Hooman. Are you ready for our meeting?

    kevquirk.com/2026-10-22-1413

Share on Mastodon

Enter the server where you have an account.