Cve on Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/tags/cve/ Recent content in Cve on Cloud Native & Open Source: A Team Lead’s Working Journal Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.164.0 en-us Sun, 09 Aug 2026 09:00:00 +0000 SCTPhantom (CVE-2026-64564): Threat-Modeling a High-Impact SCTP Kernel Flaw Without Panic https://www.msbiro.net/posts/sctphantom-cve-2026-64564-threat-modeling/ Sun, 09 Aug 2026 09:00:00 +0000 https://www.msbiro.net/posts/sctphantom-cve-2026-64564-threat-modeling/ CVE-2026-64564 (SCTPhantom) is a critical Linux kernel use-after-free in SCTP ASCONF with a high CVSS score and a demonstrated container escape. A DevSecOps threat-modeling walkthrough of when to care, who is actually at risk, and how to prioritize patching without panic, accounting for attacker-creatable SCTP associations. CVE-2026-31431 Copy Fail: A Nine-Year-Old Kernel Bug, a 732-Byte Script, and a Root Shell https://www.msbiro.net/posts/cve-2026-31431-copy-fail-linux-kernel-privilege-escalation/ Fri, 01 May 2026 09:00:00 +0100 https://www.msbiro.net/posts/cve-2026-31431-copy-fail-linux-kernel-privilege-escalation/ CVE-2026-31431 Copy Fail is a local privilege escalation in the Linux kernel exploitable with a 732-byte Python script. This post covers what it is, how to fix it, what to do when patching isn't immediate, and why runtime detection is the control that actually matters. 2025 CWE Top 25: Mitre's Critical Software Weakness Rankings and Trends https://www.msbiro.net/posts/top25mitre2025/ Wed, 17 Dec 2025 05:19:07 +0000 https://www.msbiro.net/posts/top25mitre2025/ Mitre's 2025 CWE Top 25 reveals persistent threats like XSS and SQL Injection atop the list, with rising authorization flaws and memory bugs signaling DevSecOps priorities for cloud-native apps. Explore the top 10 changes from 2024, key trends, and how CWE root causes differ from CVEs. Urgent: Zero-Day CVEs Found in Two Major Secrets Managers — Have You Updated Yet? https://www.msbiro.net/posts/0day-cves-secrets-manager/ Mon, 11 Aug 2025 12:39:03 +0000 https://www.msbiro.net/posts/0day-cves-secrets-manager/ This article highlights recent zero-day vulnerabilities discovered in CyberArk and HashiCorp secrets managers, emphasizes the importance of timely software updates, and offers practical advice for staying proactive about security patches.