The graphapi app bundled in ownCloud’s Docker deployment images exposed mail credentials, database passwords, and S3 keys to unauthenticated visitors — a mis-packaged dependency that became full infrastructure compromise. CISA KEV-listed it within ten days.
For much of 8 November 2023, ChatGPT and parts of OpenAI’s API cycled in and out of service under a denial-of-service wave claimed by Anonymous Sudan, with smaller recurrences through the month. OpenAI confirmed the DDoS, rolled global WAF rules, and absorbed a false-positive tax on legitimate users. Nothing was breached — the story is availability risk wrapped around AI dependence. This post walks the campaign’s anatomy, Microsoft’s Storm-1359 telemetry link, and the business-continuity lessons for anyone running on AI vendors.
CVE-2023-46747 let unauthenticated attackers smuggle requests through BIG-IP TMM into the iControl REST management plane — a framing bug that became full device compromise. Exploitation followed the October patch within days, and CISA put it on the KEV catalog before month end.
CVE-2022-42475 was a CVSS 9.8 pre-auth heap overflow in FortiOS SSL-VPN, patched silently then confirmed exploited. Edge memory safety lessons.
August’s ‘contained’ developer-account compromise returned in December as stolen vault backups. Inside the two-act breach.
Five thousand cloud VMs, each pushing 5,000 rps of encrypted traffic at one small website. June 2022’s record flood and the edge doctrine it sealed.
Exploited in the wild two days before the patch existed. How OGNL injection turned Confluence into June 2022’s internet-scale fire drill — and the playbook it left behind.
A JDK 9 property path reopened a 2010-era bug class in Spring’s data binder — and gave every Tomcat admin a very bad 48 hours.
One stale pipe flag let unprivileged users overwrite read-only files — /etc/passwd included — for 18 months on every modern Linux kernel.
OMB’s January 2022 mandate gave zero trust deadlines, named technologies, and an oversight structure — rewriting industry roadmaps worldwide.
A mod_lua multipart buffer overflow announced ten days after Log4Shell. Narrow exposure, but a masterclass in triage under fatigue.
A single JNDI lookup string turned every Java logger into a front door. The anatomy, response, and lasting lessons of Log4Shell.