September 2024

CUPS RCE: The Linux Printing Story That Went Viral Before CVEs Landed

Post author:Prabhu Kalyan Samal
Post published:September 28, 2024
Post category:Cloud & Infrastructure Security Web & API Security

In late September 2024, researcher Simone Margaritelli disclosed a chain of CUPS vulnerabilities — CVE-2024-47076, CVE-2024-47176 and siblings — allowing same-network attackers to register malicious printers and achieve code execution as the lp user via broadcast-trusting auto-configuration. Preceded by a hype-teaser countdown that split the community, the episode became the year's clearest study in disclosure-process dysfunction, severity theater, and the quiet ubiquity of trust-the-LAN daemons. This account covers the chain mechanics, the honest exposure math, and what to disable today.

Kia’s Web Portal: Register Any Car’s Account, Control It From Your Phone

Post author:Prabhu Kalyan Samal
Post published:September 27, 2024
Post category:Cloud & Infrastructure Security Web & API Security

On September 25, 2024, researchers Karan Saini and Sam Curry published an access-control flaw in Kia's dealer and consumer web infrastructure: given only a license plate, an attacker could register an account with remote lock, unlock, start, stop, locate and horn control over 2014-2025 connected vehicles they did not own. Kia patched in August before disclosure. This account walks the plate-to-command chain, the ownership-verification gap, the threat model for tracking and theft, and the automotive-API authorization lesson that outlasts the brand.

TfL 2024: A 17-Year-Old, a Social Engineer’s Approach and Oyster Chaos

Post author:Prabhu Kalyan Samal
Post published:September 25, 2024
Post category:Cloud & Infrastructure Identity & Phishing Security

On September 5, 2024, Transport for London detected an intrusion begun days earlier through social engineering of staff — and within a week a 17-year-old was arrested, then charged under the Computer Misuse Act, for a breach that exposed contact details and the bank details of roughly 3,000 Oyster refund customers. This account reconstructs the phishing entry, the lateral movement, the containment that took status boards and the refund portal offline, the NCSC-NCA response, and the municipal-security lessons that outlasted the headlines.