Week 32 Security Roundup: The Management Plane Is the Target
TeamCity, N-central, and Cisco FMC put the same lesson in three different packages: attackers want the systems that already control everything else.
Threat Intelligence & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth red team tactics, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Featured
Latest analysis
Archive
Recent posts
DEF CON 34: The Hacker Party That Became the World's Biggest Hacking Conference
DEF CON started as a farewell party for a BBS sysop who never showed up. 33 years later it draws more than 30,000 people, shapes election security policy, and lets autonomous AI agents hunt flags.
TrojPix: Stealing Data from an Air-Gapped Computer Through Its Display Cable
USENIX Security 2026 research shows how imperceptible pixel changes can turn a digital display cable into an electromagnetic covert channel. The result is real, but so are its prerequisites.
NGINX's Configuration-Dependent Vulnerabilities: Why Version Scanning Is Not Enough
NGINX 1.30.4 and 1.31.3 fixed three new memory-safety flaws, but exposure depends on map, slice, SSI, proxy, and buffering configuration. Here is how to audit the real path.
Your UniFi Console Is a Server: What Security Bulletin 066 Actually Requires
Ubiquiti disclosed 25 vulnerabilities across UniFi applications and devices. The critical issue is not the headline CVSS score, but which management services an attacker can reach.
One Email Preview Is Enough: Russia's Half-Click Webmail Exploits
Russian-aligned espionage groups exploited stored XSS flaws in Zimbra, SOGo, Roundcube, MDaemon, and Kerio. Opening a message was enough to lose credentials, email, and persistent access.
CVE-2026-48282: A Perfect 10 in Adobe ColdFusion, Exploited Within Two Hours
A CVSS 10.0 path traversal in Adobe ColdFusion's Remote Development Services lets unauthenticated attackers write a webshell straight into the web root. Attackers were probing it before most admins finished reading the advisory.