Tagged “appsec”
5 posts
CVE-2024-21762: FortiOS RCE that needed no login at all
A heap out-of-bounds write in FortiOS SSL-VPN let unauthenticated attackers run code as root — and 150,000 devices were still exposed when it went public.
securitycvenetworkingappsec
Citrix Bleed: how a memory leak beat MFA outright
CVE-2023-4966 let attackers steal live NetScaler session tokens and walk straight past authentication and MFA — no credentials needed at all.
securitycvenetworkingappsec
Java deserialization after Log4Shell: CVE-2023-46604
Apache ActiveMQ's unauthenticated RCE shows Java deserialization bugs never went away after Log4Shell — only the exploitation playbook got faster.
securityjavacveappsec
Leaked credentials in public repos get used in minutes
GitGuardian logged 28.65M secrets on public GitHub in 2025, and researchers have watched leaked AWS keys get abused in under five minutes.
securitygithubsecretsappsec
MOVEit and the MFT zero-day exploitation playbook
CVE-2023-34362 turned one SQL injection in MOVEit Transfer into 2,700+ breached organizations — and the same pattern keeps repeating against MFT software.
securitycveransomwareappsec