Technical Advisory
CitrixBleed required a session response
CVE-2023-4966 linked a memory-disclosure flaw to reusable sessions that needed a separate recovery decision.
Event / disclosure
Publications
The library
Security cases, technical advisories and analysis. Browse the record by event date, subject or product.
24 publications. Browse by event date below, or use the incident archive for a year-by-year view. Publication dates appear on each article.
Technical Advisory
HTTP/2 Rapid Reset: map the work a cancelled stream leaves behind
CVE-2023-44487 made request churn and protocol termination more useful questions than a connection count alone.
Event / disclosure
Analysis
WebP decoding reaches well beyond the browser
CVE-2023-4863 required inventory of browsers, embedded renderers and image-processing workers.
Event / disclosure
Analysis
MOVEit: patching the transfer server did not settle the data exposure question
The 2023 campaign separated two jobs that incident tickets often collapse: closing the vulnerability and investigating earlier access.
Event / disclosure
Analysis
One compromised supplier led into 3CX’s build systems
The 3CX investigation traced a compromised software input into another vendor’s release environment.
Event / disclosure
Technical Advisory
AiTM phishing: why a completed MFA prompt can still end in session theft
The recovery task follows the stolen session into the mailbox, its persistence settings and the business conversations it exposed.
Event / disclosure
Technical Advisory
Spring4Shell depends on how the application is deployed
Assess CVE-2022-22965 using the actual runtime, Spring dependencies, packaging and servlet container.
Event / disclosure
Analysis
Log4Shell: the dependency inventory that patching could not replace
A retrospective on embedded Java dependencies, incomplete early fixes and the evidence needed to close a remediation ticket.
Event / disclosure
Analysis
ProxyLogon left more to investigate than a patch level
Exchange patch state, earlier exploitation and persistent access need separate evidence in a ProxyLogon response.
Event / disclosure
Analysis
SolarWinds put management-plane trust under scrutiny
SUNBURST made software provenance, management identities and independent recovery part of the same investigation.
Event / disclosure
Analysis
NotPetya spread through credentials as well as exploits
The NotPetya record connects a poisoned update, stolen credentials and remote administration across recovery boundaries.
Event / disclosure
Analysis
WannaCry exposed a gap in patch verification
WannaCry, MS17-010 and the gap between a patch notice, installed software and a service that can recover.
Event / disclosure