Fermín J. Serna

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

6

1 Comment

The Apache Tika toolkit, the industry standard for detecting and extracting metadata from over a thousand file types, has issued a maximum-severity alert. A critical XML External Entity (XXE) vulnerability, tracked as CVE-2025-66516, poses a catastrophic risk to applications relying on Tika for content analysis. With a CVSS score of 10.0, this flaw allows attackers to compromise servers simply by uploading a malicious PDF.

2

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

145

11 Comments

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

I've updated the page for the Encyclopedia of Crash Dump Analysis Patterns, Third Edition, adding all available purchase options https://lnkd.in/gckWeNxe

5

SIEM has been around for 20 years, yet most people don’t really understand it - even after working with SIEMs for years. A SIEM is not a product. It’s not even a product category. It’s not about tech at all. A SIEM is a reflection of how security is managed and viewed within a company. "Market-leading" SIEMs can fail miserably. So-called "legacy" or "bad" SIEMs can quietly deliver significant, tangible outcomes. A SIEM is a blueprint - on paper, an architectural masterpiece soaring (pun intended) into the sky. It can be just that. More often, the architect’s dream is simply the contractor’s nightmare. Let’s not even mention the maintenance crews who have to deal with it once it’s built. It’s common to spend millions and still have zero meaningful coverage. To centralize all the data only to find it contains nothing of value. To query all day and come back empty-handed. A SIEM is a mirror. Of priorities, decisions, execution capabilities, attention to detail, objective setting, resource allocation, and how well the business, its processes, and its risks are understood. Show me your SIEM, and I’ll tell you who you are. So, what’s being shown in your mirror? #SIEM #SOC #SecurityOperations #cyber

163

2 Comments

We all know the story: you finally get your logs into Splunk… and then spend hours untangling timestamps, sourcetypes, and formats that don’t line up. The reality? Broken data ingestion silently erodes threat detection. SOC teams lose visibility. Alerts misfire. Storage costs rise. That’s why Axoflow is heading to Splunk .conf25 in Boston. We’ll be sharing how we’ve tackled ingestion and parsing problems at scale, turning noisy, inconsistent logs into clean, structured, actionable data. Our team is ready to discuss real-world fixes for the problems that drain time and budget: Balázs Scheidler Sándor Guba Neil Boyd Mark Bonsack Laurakate Bayman If ingestion is still your bottleneck, what’s stopping you from fixing it upstream instead of in your SIEM? See you at .conf25. 🚀 #conf25 #splunk #SIEMOps #SOCWorkflows

23

2 Comments

Security teams aren't under-skilled. They're outpaced. ORDR IQ applies AI where friction hits hardest: analysis, enforcement, and orchestration. One question replaces hours of coordination. Same team. Different scale.

9

A staggering 544 million plain text credentials have been exposed via an unsecured Elasticsearch instance. Misconfigured databases continue to be a critical blind spot for organizations. When credentials of this magnitude are leaked in plain text, threat actors are handed the keys to execute widespread credential stuffing and account takeover attacks. Security leaders and SOC teams must maintain strict visibility over their attack surface to prevent similar exposures. Read more: https://lnkd.in/geK-3tRG #CyberSecurity #DataBreach #ThreatIntel #CISO #SOC

4