From the Desk
DevSecOps Engineer
Secure development, cloud security, CI/CD pipeline protection, tooling.
20
Stories filed
5
Desks covered
≥ 6/10
Editorial floor
Coverage:DevSecOpsCloudToolsVulnerabilitiesOT/IoT Security
§
On the DevSecOps Engineer Desk
The latest stories filtered for your beat, organised by sub-section.
Vulnerabilities16 stories
- SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks3d
- QNAP says hackers breaching NAS devices in Plex2Shell attacks3d
- Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last TimeThe finding reveals a systemic flaw in WordPress's update mechanism: the update unpacks using the old vulnerable code, creating a transient but exploitable window for every affected site.3d
- [NEU] [mittel] JetBrains CLion: Mehrere SchwachstellenJetBrains CLion vulnerabilities allowing code execution and information disclosure directly affect developer workstations — a privileged tier in the software supply chain.3d
- [UPDATE] [mittel] Keycloak: Mehrere SchwachstellenAdditional Keycloak security-bypass and data-manipulation flaws compound earlier advisories; ensuring all patches are applied in aggregate is essential for IAM integrity.3d
- [UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenMemory corruption in the kernel can undermine container sandboxing; build and staging environments on shared hosts are particularly at risk.3d
- [UPDATE] [mittel] Keycloak: Mehrere SchwachstellenKeycloak is a core IAM component in many microservice architectures; privilege-escalation to admin compromises every downstream service relying on it for authn/authz.3d
- [UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenContainer hosts and CI runners typically share the host kernel — unpatched privilege-escalation flaws can break container isolation boundaries.3d
- [NEU] [mittel] JetBrains WebStorm: Mehrere Schwachstellen ermöglichen CodeausführungWebStorm code-execution flaws affect front-end development teams; while rated medium, exploitation through crafted projects remains a realistic supply-chain entry point.3d
- [NEU] [hoch] JetBrains IntelliJ IDEA: Mehrere SchwachstellenIntelliJ IDEA is the primary IDE across many Java/Kotlin shops; RCE and file-manipulation flaws mean that opening a poisoned repository could compromise a developer workstation.3d
- [NEU] [hoch] JetBrains You Track: Mehrere SchwachstellenYouTrack is deeply embedded in many dev workflows; high-severity flaws enabling RCE and privilege escalation directly threaten CI/CD-adjacent tooling and could be leveraged for supply-chain pivots.3d
- [NEU] [hoch] Wazuh: Mehrere SchwachstellenWazuh agents deployed in CI/CD and container environments share the same vulnerabilities; a compromised agent can serve as an entry point into build infrastructure.3d
- [UPDATE] [mittel] Keycloak: Schwachstelle ermöglicht Erlangen von AdministratorrechtenIf Keycloak admin access is compromised, an attacker can tamper with OIDC configurations used by your deployment pipelines, potentially injecting malicious redirect URIs or scopes.3d
- [UPDATE] [hoch] Mozilla Firefox und Thunderbird: Mehrere Schwachstellen3d
- [UPDATE] [mittel] CoreDNS: Schwachstelle ermöglicht Denial of ServiceCoreDNS is a default DNS provider in Kubernetes clusters; a remotely exploitable DoS flaw can disrupt service discovery across your entire container platform.3d
- [UPDATE] [hoch] RedHat Build of Keycloak: Mehrere SchwachstellenKeycloak often sits in CI/CD and microservice auth chains; unpatched instances may expose service-to-service tokens and secrets.3d
OT/IoT Security1 story
Cloud2 stories
- Addressing protocol security gaps in multi-tenant KubernetesProtocols like ADB and WebRTC lack enterprise authentication and use unencrypted channels by default—in multi-tenant Kubernetes clusters this creates lateral-movement and data-leakage risks across tenant boundaries.3d
- Principal Problems: App Registrations, Service Principals, and the Hidden Risk of Multi-Tenant AppsDevelopers often conflate app registrations with service principals, inadvertently granting excessive cross-tenant permissions that persist long after initial onboarding.3d