Cybersecurity
Vulnerabilities, exploits, cryptography and defensive engineering — written by people who patch real servers.
$ cat START_HERE.md
Self-hosted email is losing to Gmail's hard SMTP rejections. Self-hosted password managers are split down the middle. And self-hosted music is doing the opposite of what you'd expect.
Part 1 ended on a 70-gigabyte breach in 2021. Since then, hacktivists derailed trains, dumped molten steel on camera, and reached grids in three countries.
Forum Archaeology #1: I built plugins for this software when it ran half the internet's communities. Sixteen years after the exodus that should have killed it, vBulletin is still getting hit with critical, unauthenticated remote code execution.
$ ls -t ~/cybersecurity
CVE-2026-110447 is a pre-auth command injection in Nextcloud's built-in Collabora CODE server, exploited since September and now in CISA KEV. The fix shipped a month earlier in a commit titled "tidy up how the coolwsd launch command is built," with no advisory. Disabling the app does not close it.
The November 2026 Next.js security release patches seven issues, and six live in the new Cache Components layer, the feature meant to make your app faster by remembering more. Three hit self-hosted next start specifically: the ones Vercel's own platform quietly absorbs.
In 2019 Max Justicz showed apt would install a package an attacker swapped in over a redirect. In November 2026 he did it again, CVE-2026-109518, through a different door that ends in the same place: code as root from a man in the middle. The fix shows how apt reuses files on disk.
CVE-2026-123158 lets an attacker log into a locked account on musl-based systems like Alpine by sending a password nobody set. The trigger is one number, 257, and the reason is a C library returning a single asterisk. I reproduced the exact boundary against musl 1.2.4 and read the fix.
Composer 2.11 shipped a cooldown that refuses to install a version until it has aged. vlt now holds npm publishes until their dependencies actually exist, because 22% of new npm versions land broken. And Ruby Central's reviewers threw out 90% of what an AI scanner flagged.
Volexity caught an attacker chaining zero-days into unauthenticated root on an Ivanti Connect Secure appliance running the latest build. The payload never touched disk, commands rode in over the same HTTPS requests as the exploit, and Ivanti's Integrity Checker reported no modifications.
Gitea 28.3.0 landed November 1 with twenty-one CVE fixes. Read the list and a pattern jumps out: more than half are the same failure repeated across different route handlers, where a token scoped to public data gets handed private data anyway. That's not twenty-one mistakes.
CVE-2026-98432 is a use-after-free in the IPv4 TCP handshake, reachable by anybody who can reach a listening port, sitting in the kernel since 4.4. Red Hat scored it 5.9 moderate and deferred the fix. Then 8.1. Then 9.8.
Running a proxy means turning authentication off on every server behind it. BungeeCord's own documentation admits what that costs you, and Velocity's docs are blunt that forwarding is not a substitute for a firewall. Here's the attack, and the exact config that closes it.
After five years, Stalwart hit its first stable release on October 26 with benchmarks claiming it beats Postfix and Dovecot in 35 of 38 head-to-head tests. Every one of those numbers was produced by the vendor.
Two critical PHP flaws landed October 21 and were in CISA's exploited-vulnerabilities catalog five days later. The 9.2 score isn't the part that should bother you. It's where the bug lives — it goes off while PHP is still assembling $_POST, before a single line of your application has run.
Vaultwarden gives you a Bitwarden-compatible password server in one container and about ten minutes. The defaults that make that possible leave org creation open, audit logging off, accounts on PBKDF2, and a rate limiter that trusts a header anyone can set.
$ ssh community@sudosecurity
Ask in the forums, share a snippet, or work through a course on Learn.
