DEV Community

Diego Diaz profile picture

Diego Diaz

Systems Engineering student building Sable & AEGIS. Cybersecurity, pentesting & AI enthusiast. Coding from Dominican Republic 🇩🇴

Joined Joined on  Personal website https://sable.somoswilab.com/
Ollama Model Loading RCE: Three Years of the Same Bug Class, One Self-Hosted LLM Runtime
alejandxr profile

Ollama Model Loading RCE: Three Years of the Same Bug Class, One Self-Hosted LLM Runtime

#rce #ollama #llmsecurity #modelloading
Comments
7 min read
LMDeploy SSRF Vulnerability Exploited Within 13 Hours: What You Need to Know
alejandxr profile

LMDeploy SSRF Vulnerability Exploited Within 13 Hours: What You Need to Know

#cve202633626 #ssrf #lmdeploy #aisecurity
Comments
2 min read
Itron Smart Meter Breach: 28M Utility Customers Exposed via API Flaw
alejandxr profile

Itron Smart Meter Breach: 28M Utility Customers Exposed via API Flaw

#breach #iot #apisecurity #utility
Comments
5 min read
GitHub Actions Supply Chain in 2026: tj-actions, Trivy, Bitwarden, and the Year the Bots Showed Up
alejandxr profile

GitHub Actions Supply Chain in 2026: tj-actions, Trivy, Bitwarden, and the Year the Bots Showed Up

#supplychain #githubactions #cicd #backdoor
Comments
8 min read
Adobe Reader Zero-Day CVE-2026-34621: Prototype Pollution + Use-After-Free Exploited Since November 2025
alejandxr profile

Adobe Reader Zero-Day CVE-2026-34621: Prototype Pollution + Use-After-Free Exploited Since November 2025

#cve #adobe #acrobatreader #zeroday
Comments
7 min read
SonicWall SMA 1000 Series Hit by Active Zero-Day Exploits (CVE-2026-15409 & CVE-2026-15410)
alejandxr profile

SonicWall SMA 1000 Series Hit by Active Zero-Day Exploits (CVE-2026-15409 & CVE-2026-15410)

#sonicwall #zeroday #cve202615409 #cve202615410
Comments
2 min read
Lovable BOLA: 48 Days, Five API Calls, Source Code + Database Credentials of Other People's Projects
alejandxr profile

Lovable BOLA: 48 Days, Five API Calls, Source Code + Database Credentials of Other People's Projects

#bola #apisecurity #aiplatform #vibecoding
Comments
7 min read
Kubernetes RBAC in 2026: From nodes/proxy to AKS CVE-10.0 — Three Real Paths to Cluster-Admin
alejandxr profile

Kubernetes RBAC in 2026: From nodes/proxy to AKS CVE-10.0 — Three Real Paths to Cluster-Admin

#kubernetes #rbac #privilegeescalation #helm
Comments
7 min read
CVE-2026-41940: cPanel Auth Bypass Exploited 65 Days as 0-Day, 1.5M Servers Exposed
alejandxr profile

CVE-2026-41940: cPanel Auth Bypass Exploited 65 Days as 0-Day, 1.5M Servers Exposed

#cve #cpanel #whm #authbypass
Comments
7 min read
France's ID Agency Breach Exposes 19 Million Passport and National ID Records
alejandxr profile

France's ID Agency Breach Exposes 19 Million Passport and National ID Records

#databreach #france #identity #government
Comments
4 min read
cPanel Zero-Day CVE-2026-41940: Authentication Bypass Hit 1.5M Servers Before Patch
alejandxr profile

cPanel Zero-Day CVE-2026-41940: Authentication Bypass Hit 1.5M Servers Before Patch

#cve202641940 #cpanel #zeroday #authenticationbypass
Comments
3 min read
CVE-2026-41940: cPanel Authentication Bypass Hit 1.5M Servers Before Anyone Noticed
alejandxr profile

CVE-2026-41940: cPanel Authentication Bypass Hit 1.5M Servers Before Anyone Noticed

#cpanel #cve202641940 #zeroday #authenticationbypass
Comments
3 min read
Next.js API Security Vulnerabilities: The 10 Most Common Findings (2026)
alejandxr profile

Next.js API Security Vulnerabilities: The 10 Most Common Findings (2026)

#pentest101 #indie #vibecoding
Comments
6 min read
¿Qué es el Pentesting? Guía Completa 2026 para Startups
alejandxr profile

¿Qué es el Pentesting? Guía Completa 2026 para Startups

#pentest101 #indie
Comments
5 min read
Supabase Security Checklist 2026: 15 Checks Esenciales para ProducciĂłn
alejandxr profile

Supabase Security Checklist 2026: 15 Checks Esenciales para ProducciĂłn

#pentest101 #indie #prelaunch
Comments
5 min read
Startup Security Audit Checklist 2026: 50 Checks Before You Ship
alejandxr profile

Startup Security Audit Checklist 2026: 50 Checks Before You Ship

#pentest101 #indie #prelaunch
Comments
5 min read
CVE-2026-32202: APT28 Exploits Incomplete Windows Patch to Steal NTLM Hashes Zero-Click
alejandxr profile

CVE-2026-32202: APT28 Exploits Incomplete Windows Patch to Steal NTLM Hashes Zero-Click

#cve202632202 #apt28 #windowssecurity #ntlmhash
Comments
3 min read
Penetration Testing for Startups in 2026: The Complete Founder's Guide
alejandxr profile

Penetration Testing for Startups in 2026: The Complete Founder's Guide

#pentest101 #indie
Comments
8 min read
CVE-2026-23918: Apache HTTP/2 Double-Free Flaw Lets Attackers Crash Servers and Potentially Execute Remote Code
alejandxr profile

CVE-2026-23918: Apache HTTP/2 Double-Free Flaw Lets Attackers Crash Servers and Potentially Execute Remote Code

#cve202623918 #apachehttpserver #http2 #remotecodeexecution
Comments
4 min read
Ivanti EPMM CVE-2026-6973 RCE Is Under Active Exploit — Patch by Sunday
alejandxr profile

Ivanti EPMM CVE-2026-6973 RCE Is Under Active Exploit — Patch by Sunday

#cve20266973 #ivantiepmm #rce #cisakev
Comments
4 min read
I scanned 100 vibe-coded apps. 73 had a BOLA.
alejandxr profile

I scanned 100 vibe-coded apps. 73 had a BOLA.

#vibecoding #prelaunch #indie
Comments
6 min read
The 8-item security checklist no one tells indie devs
alejandxr profile

The 8-item security checklist no one tells indie devs

#prelaunch #indie #pentest101
Comments
6 min read
Dirty Frag: Chained Linux Kernel Flaws Give Root on Every Major Distribution
alejandxr profile

Dirty Frag: Chained Linux Kernel Flaws Give Root on Every Major Distribution

#linuxkernel #privilegeescalation #cve202643284 #cve202643500
Comments
4 min read
How BOLA killed my MVP (and what I wish I'd done before launch)
alejandxr profile

How BOLA killed my MVP (and what I wish I'd done before launch)

#indie #breach #pentest101
Comments
5 min read
Fake OpenAI Repo on Hugging Face Delivered Rust Infostealer to 244,000 Developers
alejandxr profile

Fake OpenAI Repo on Hugging Face Delivered Rust Infostealer to 244,000 Developers

#huggingface #supplychainattack #infostealer #openai
Comments
4 min read
Two Critical CVEs Hit Hugging Face: TGI DoS (CVE-2026-0599) and LeRobot Unauthenticated RCE (CVE-2026-25874)
alejandxr profile

Two Critical CVEs Hit Hugging Face: TGI DoS (CVE-2026-0599) and LeRobot Unauthenticated RCE (CVE-2026-25874)

#huggingface #cve20260599 #cve202625874 #textgenerationinference
Comments
5 min read
Exim CVE-2026-45185 — Unauthenticated RCE in the World's Most Deployed Mail Server
alejandxr profile

Exim CVE-2026-45185 — Unauthenticated RCE in the World's Most Deployed Mail Server

#exim #cve202645185 #rce #mailserver
1
Comments
3 min read
Hackers Used AI to Build a Zero-Day That Bypasses Two-Factor Authentication — Google Stopped It
alejandxr profile

Hackers Used AI to Build a Zero-Day That Bypasses Two-Factor Authentication — Google Stopped It

#aithreats #zeroday #2fabypass #googlegtig
Comments
4 min read
Mini Shai-Hulud Worm Hits 172 npm Packages — Including TanStack, Mistral AI, and Guardrails AI
alejandxr profile

Mini Shai-Hulud Worm Hits 172 npm Packages — Including TanStack, Mistral AI, and Guardrails AI

#supplychainattack #npmworm #shaihulud #tanstack
Comments
3 min read
Microsoft Patches 138 Vulnerabilities: Netlogon and DNS RCE Flaws Lead May Update
alejandxr profile

Microsoft Patches 138 Vulnerabilities: Netlogon and DNS RCE Flaws Lead May Update

#microsoft #patchtuesday #cve202641089 #cve202641096
Comments
4 min read
Hugging Face Double CVE: TGI DoS and LeRobot RCE Expose AI Infrastructure
alejandxr profile

Hugging Face Double CVE: TGI DoS and LeRobot RCE Expose AI Infrastructure

#huggingface #cve20260599 #cve202625874 #aisecurity
Comments
4 min read
NGINX Rift: 18-Year-Old Heap Overflow Lets Attackers Hijack One-Third of the Web
alejandxr profile

NGINX Rift: 18-Year-Old Heap Overflow Lets Attackers Hijack One-Third of the Web

#nginx #cve202642945 #rce #supplychain
Comments
3 min read
PraisonAI Auth Bypass Was Scanned 4 Hours After Disclosure — And It's an AI Agent Framework
alejandxr profile

PraisonAI Auth Bypass Was Scanned 4 Hours After Disclosure — And It's an AI Agent Framework

#praisonai #cve202644338 #aiagents #authbypass
Comments
4 min read
Microsoft Patch Tuesday 2026: 622 Fixes Including Two Actively‑Exploited Zero‑Days
alejandxr profile

Microsoft Patch Tuesday 2026: 622 Fixes Including Two Actively‑Exploited Zero‑Days

#microsoftpatch #zeroday #cve202656155 #sharepoint
Comments
2 min read
Claw Chain: Four OpenClaw Vulnerabilities Expose 245,000 AI Agent Servers to Data Theft
alejandxr profile

Claw Chain: Four OpenClaw Vulnerabilities Expose 245,000 AI Agent Servers to Data Theft

#openclaw #clawchain #cyera #aiagentsecurity
Comments
3 min read
Cisco SD-WAN Auth Bypass CVE-2026-20182 Added to CISA KEV — Patch by May 17
alejandxr profile

Cisco SD-WAN Auth Bypass CVE-2026-20182 Added to CISA KEV — Patch by May 17

#cisco #sdwan #cve202620182 #cisakev
Comments
3 min read
Microsoft Exchange OWA Zero-Day CVE-2026-42897 Exploited via Crafted Emails
alejandxr profile

Microsoft Exchange OWA Zero-Day CVE-2026-42897 Exploited via Crafted Emails

#microsoftexchange #zeroday #cve202642897 #xss
Comments
3 min read
Turla Upgrades Kazuar Backdoor Into Modular P2P Botnet
alejandxr profile

Turla Upgrades Kazuar Backdoor Into Modular P2P Botnet

#turla #kazuar #apt #p2pbotnet
Comments
3 min read
Grafana GitHub Token Theft: Codebase Downloaded, Ransom Rejected
alejandxr profile

Grafana GitHub Token Theft: Codebase Downloaded, Ransom Rejected

#grafana #github #supplychain #tokentheft
Comments
3 min read
Microsoft Dismantles Fox Tempest: The $9K Malware-Signing Service Behind Ransomware's Trust Exploit
alejandxr profile

Microsoft Dismantles Fox Tempest: The $9K Malware-Signing Service Behind Ransomware's Trust Exploit

#foxtempest #malwaresigning #ransomware #microsoft
Comments
4 min read
Nx Console 18.95.0: How a 2.2M-Install VS Code Extension Became a Credential Stealer
alejandxr profile

Nx Console 18.95.0: How a 2.2M-Install VS Code Extension Became a Credential Stealer

#supplychain #vscodeextension #credentialtheft #nxconsole
Comments
3 min read
TeamPCP Breaches GitHub: 3,800 Internal Repos Exfiltrated via Poisoned VS Code Extension
alejandxr profile

TeamPCP Breaches GitHub: 3,800 Internal Repos Exfiltrated via Poisoned VS Code Extension

#githubbreach #teampcp #supplychain #vscodeextension
5
Comments
4 min read
CVE-2026-9082: Unauthenticated SQL Injection in Drupal Core Lets Attackers Execute Remote Code on PostgreSQL Sites
alejandxr profile

CVE-2026-9082: Unauthenticated SQL Injection in Drupal Core Lets Attackers Execute Remote Code on PostgreSQL Sites

#drupal #cve20269082 #sqlinjection #rce
5
Comments
4 min read
Chrome 146 Zero-Days: The Skia and V8 Attack Surface, 2026 Edition
alejandxr profile

Chrome 146 Zero-Days: The Skia and V8 Attack Surface, 2026 Edition

#chrome #zeroday #skia #v8
Comments
6 min read
AEGIS: Open-Source SOAR for Indie Founders
alejandxr profile

AEGIS: Open-Source SOAR for Indie Founders

#aegis #soar #opensource #indie
Comments
9 min read
Audit a Cursor or v0-Built MVP Before You Launch
alejandxr profile

Audit a Cursor or v0-Built MVP Before You Launch

#vibecoding #cursor #v0 #mvp
5
Comments
8 min read
The 2026 Vibe-Coder Security Checklist: 17 Items
alejandxr profile

The 2026 Vibe-Coder Security Checklist: 17 Items

#checklist #vibecoding #indie #prelaunch
5
Comments
9 min read
Cisco Patches CVSS 10.0 Flaw in Secure Workload — Unauthenticated Attackers Could Gain Site Admin via API
alejandxr profile

Cisco Patches CVSS 10.0 Flaw in Secure Workload — Unauthenticated Attackers Could Gain Site Admin via API

#cisco #cve202620223 #cvss10 #restapi
5
Comments
4 min read
Megalodon: How 5,561 GitHub Repositories Got Backdoored in Six Hours
alejandxr profile

Megalodon: How 5,561 GitHub Repositories Got Backdoored in Six Hours

#githubactions #supplychain #cicdsecurity #devsecops
Comments 1
4 min read
Crunchyroll Breach: How a Telus Supply-Chain Compromise Let Attackers In — and What to Hunt For
alejandxr profile

Crunchyroll Breach: How a Telus Supply-Chain Compromise Let Attackers In — and What to Hunt For

#crunchyroll #supplychain #tellus #breach
Comments
5 min read
The MCP Confused Deputy: Provenance Gaps, Instruction Injection, and DNS Rebinding in the Model Context Protocol
alejandxr profile

The MCP Confused Deputy: Provenance Gaps, Instruction Injection, and DNS Rebinding in the Model Context Protocol

#mcp #confuseddeputy #promptinjection #dnsrebinding
3
Comments
7 min read
North Korea's Lazarus Group Deploys RemotePE — A Memory-Only RAT That Leaves Zero Disk Traces
alejandxr profile

North Korea's Lazarus Group Deploys RemotePE — A Memory-Only RAT That Leaves Zero Disk Traces

#lazarus #apt #rat #filelessmalware
Comments
3 min read
CVE-2026-45659: SharePoint RCE Flaw Lets Any Site Member Execute Code Remotely
alejandxr profile

CVE-2026-45659: SharePoint RCE Flaw Lets Any Site Member Execute Code Remotely

#cve202645659 #sharepoint #rce #microsoft
Comments
4 min read
Iran's Nimbus Manticore Deploys AI-Assisted MiniFast Backdoor via Phishing and SEO Poisoning
alejandxr profile

Iran's Nimbus Manticore Deploys AI-Assisted MiniFast Backdoor via Phishing and SEO Poisoning

#nimbusmanticore #minifast #seopoisoning #phishing
Comments
4 min read
NGINX Rift: CVE-2026-42945 — An 18-Year-Old Heap Overflow Now Under Active Exploitation
alejandxr profile

NGINX Rift: CVE-2026-42945 — An 18-Year-Old Heap Overflow Now Under Active Exploitation

#nginx #cve202642945 #rce #heapoverflow
Comments
4 min read
TrapDoor: 34+ Malicious Packages Hit npm, PyPI, and Crates.io in Coordinated Supply Chain Attack
alejandxr profile

TrapDoor: 34+ Malicious Packages Hit npm, PyPI, and Crates.io in Coordinated Supply Chain Attack

#supplychain #npm #pypi #crates
Comments
4 min read
Gitea Container Registry Flaw Left 30,000 Private Image Repositories Wide Open for 4 Years
alejandxr profile

Gitea Container Registry Flaw Left 30,000 Private Image Repositories Wide Open for 4 Years

#cve202627771 #containersecurity #gitea #devops
3
Comments
4 min read
Free Scan or Full Pentest? A Decision Guide for Founders Shipping a Vibe-Coded MVP
alejandxr profile

Free Scan or Full Pentest? A Decision Guide for Founders Shipping a Vibe-Coded MVP

#pentest #freescan #startup #prelaunch
Comments
7 min read
June 2026 Patch Tuesday: An Actively-Exploited Chrome Zero-Day and a Wormable Windows RCE
alejandxr profile

June 2026 Patch Tuesday: An Actively-Exploited Chrome Zero-Day and a Wormable Windows RCE

#cve202611645 #cve202645657 #patchtuesday #chrome
Comments
2 min read
CVE-2026-42271: How a Popular AI Gateway Became an RCE Vector — And What to Audit in Your Stack
alejandxr profile

CVE-2026-42271: How a Popular AI Gateway Became an RCE Vector — And What to Audit in Your Stack

#cve202642271 #litellm #aigateway #commandinjection
Comments
3 min read
loading...