Research and briefing notes
Findings, method notes and practical guidance for organizations that must document security decisions.
Latest Research Articles
We regularly publish our security findings, guidance, and analysis to help organizations stay ahead of emerging threats.
The docs said third-party.com. That name now serves a ClickFix.
third-party.com is not a reserved placeholder. Someone registered it and has been serving a Windows ClickFix since June. 1,700 GitHub hits. Use example.com. Flash the GS1900 today.
Mathew Potter
Security Analyst
cPanel says a calendar login is enough to take the whole server
CVE-2026-87899 is CalDAV and CardDAV to root. Any hosting account. Shared boxes are the blast. Fixed in 11.134.0.57, 11.136.0.41, 11.138.0.8. WP Toolkit 6.11.3 is a separate package.
Mathew Potter
Security Analyst
F5 says BIG-IP APM is being used if it hands out OAuth tokens
CVE-2026-94127 is unauthenticated code execution on APM authorization servers. CISA listed it. Due Friday. Closing the management port does not help. Engineering hotfix or F5's iRule.
Mathew Potter
Security Analyst
Last week's WordPress 7.1.1 is not this week's 7.1.2
CVE-2026-87902 is a critical core hole, no account required. 7.1.1 from September 17 is still open. Update to 7.1.2 or the matching older branch. No workaround in the project note.
Mathew Potter
Security Analyst
Saturday's Check Point LivePatch is not the July management-server hole
CVE-2026-93616 was used in targeted attacks on July 23. The web service, no login. LivePatch for 91843 does not cover it. Fix is sk1000171. Spark VPN tries since September 12 are a separate ticket.
Mathew Potter
Security Analyst
Arista says on-prem VeloCloud is being used, and the July patch is not enough
CVE-2026-93952 is a 10.0 hole in VeloCloud Orchestrator on certificate setups. Hosted is patched. 5.2 and 6.4 have builds. 6.1 and 7.0 do not. Lock the web UI.
Mathew Potter
Security Analyst
Stay updated
New briefing notes by email. No marketing list, and you can leave at any time.
We respect your privacy. Unsubscribe at any time.