This Week in Security

SecOps Field Notes
  • 0.0 (0)
  • Technology
  • Updated Weekly

The security news that matters if you actually run the network. Every Friday, a fast two-host rundown of the week's biggest CVEs, breaches and advisories — filtered through a network and infrastructure engineer's lens: what to patch, what's exposed, and what to check in your logs.

Episodes

  1. Sep 4

    Ep. 4 — Everything Trusted a Header: SonicWall, Artifactory, LiteLLM & Starlette

    CISA added seven bugs to the Known Exploited catalog on Sept 2, and they rhyme: each one believed input it had no business trusting. SonicWall SMA1000 chains a CVSS 10.0 pre-auth SSRF (CVE-2026-83548) into a 7.8 command injection (CVE-2026-83549) for unauthenticated RCE — confirmed exploited in the wild, fixed in 12.4.3-03526 / 12.5.0-02952, and exploitation predates disclosure so patching proves nothing. JFrog Artifactory (CVE-2026-82329) lets an unauthenticated attacker forge admin tokens — and upgrading does NOT invalidate tokens already forged, so rotate. LiteLLM (CVE-2026-59822) fell through to an OAuth2 passthrough that handed out an empty auth object — fixed in 1.84.0. And Starlette (CVE-2026-48710) rebuilt request.url from an unvalidated Host header, so path-based middleware can be bypassed — fixed in 1.0.1.

  2. Aug 28

    Ep. 3 — Four Edge Boxes, One Bug: NetScaler, Calix, Cisco FMC & Fortinet

    A brutal week to run an edge box: four vendors, one root cause — unauthenticated login. Citrix NetScaler ships a 9.3 authentication bypass on Gateway/AAA (CVE-2026-19490) — not exploited yet, so patch before it is. Calix routers have an unpatched flaw (CVE-2026-75501) that exposes UPnP on the WAN, letting anyone punch a permanent hole through NAT — disable UPnP or have your ISP do it. Cisco Secure FMC has an actively exploited default-credentials zero-day (CVE-2026-20316, in CISA KEV) — patch and get the management plane off the public internet. And Fortinet patched FortiWeb/FortiManager auth bypasses (CVE-2026-26035 / -70468). Homework: patch NetScaler, kill UPnP on Calix, get FMC off the internet, disable the FortiWeb wildcard, and hunt your edge auth logs.

  3. Aug 21

    Ep. 2 — VPNs Crashed by a Packet, GitLab's 9.4, and Stolen SharePoint Keys

    This week: the Cisco ASA/FTD SSL VPN flaw is still being exploited — one crafted HTTP request can crash your firewall, so patch this weekend. GitLab ships a 9.4 unauthenticated code-injection fix that attackers weaponized within days — if your router configs and CI pipelines live in self-hosted GitLab, that's your automation supply chain. Attackers hitting SharePoint are stealing machine keys, which means patching alone doesn't evict them: rotate the keys. And CERT Polska reports Zimbra Collaboration exploited in the wild — mail servers are edge infrastructure too. Homework: patch ASA/FTD, update GitLab, patch-and-rotate SharePoint, bring Zimbra current.

  4. Aug 15

    Ep. 1 — Cisco VPNs Under Attack, 421 Microsoft CVEs, and a 9.8 in DNS

    This week: attackers are actively exploiting a Cisco ASA and FTD SSL VPN flaw — unauthenticated, remote device reboots. Microsoft's August Patch Tuesday ships 421 CVEs including a 9.8 remote-code-execution bug in Windows DNS Server with no user interaction. And researchers drop ten vulnerabilities in llama.cpp, a reminder the models you self-host need patching too. The homework: patch the VPN, patch DNS, check your logs.

  • 4 Episodes

About

The security news that matters if you actually run the network. Every Friday, a fast two-host rundown of the week's biggest CVEs, breaches and advisories — filtered through a network and infrastructure engineer's lens: what to patch, what's exposed, and what to check in your logs.

Information

  • Creator
    SecOps Field Notes
  • Years Active
    2026
  • Episodes
    4
  • Rating
    Clean
  • Copyright
    © 2026 SecOps Field Notes
  • Show Website
    This Week in Security