The monitoring tool that could read the rest of the cluster's secrets
New research into Kubernetes operators shows how a useful maintenance tool can carry permissions far beyond its job. IBM's Prometurbo case makes the consequences unusually clear.
INSIGHTS & PRACTICAL GUIDANCE
Identity & access
Clear explanations and useful steps from Short Circuit LLC. For original vulnerability findings and advisories, explore our research ↗.
Explore this topic
10 ARTICLES / PRACTICAL CYBERSECURITY
HFS could accept a forged login even when nobody knew the password
The HFS vulnerability exposes a gap between checking a password and trusting the session that follows. Here is what the July fix changed, why the flaw mattered and what October attack observations establish.
An Atlassian file leak can expose the trust between your business tools
CVE-2026-21589 exposes particular files in Atlassian applications. The consequences depend on what those files contain and which other systems will trust the credentials inside them.
The Cisco flaw that exposes the system managing your branches
Cisco SD-WAN Manager oversees the settings used across branch networks. Its authentication flaw puts that authority at risk. Understanding its job makes the patching and investigation decisions easier to follow.
Two curl bugs in Apple’s updates: redirects, proxies and credential mix-ups
The curl advisories describe a bearer token following the wrong destination and a proxy connection reused with the wrong identity. Each is a credential-state failure rather than memory corruption.
macOS Accounts CVE-2026-43749: how path handling can lead to root
Apple fixed a directory-path parsing issue in the Accounts component. The advisory reports potential root privileges for an app, while leaving the precise path-handling failure unpublished.
SharePoint CVE-2026-69465: when a signed-in user has too much access
Microsoft’s missing-authorization fix needs more than a package install. Review the affected SharePoint edition, Workflow Manager prerequisite and upgrade status across the farm.
Apple’s Screen Sharing fix: CVE-2026-65400 and unauthenticated access
Apple repaired an authentication-state flaw in macOS Screen Sharing. Check the affected release branch, who can reach the service and whether older access needs investigation.
Authenticator codes or passkeys: what changes when you sign in?
Both can improve on a password alone, but they protect against different attacks. Understand TOTP secrets, WebAuthn origin checks, recovery and the sessions left open after login.