Thoughts, tutorials, and insights on IT infrastructure, cybersecurity, and systems administration.
A Linux rootkit on compromised F5 BIG-IP APM appliances hooks Apache's PHP loader to inject a web shell straight into memory, leaving the on-disk webtop scripts byte-for-byte clean. It's tied to the exploited CVE-2025-53521, and it's a working blueprint for fileless persistence on the access gateways guarding enterprise identity.
Kestra's auth filter whitelisted /configs with a suffix match instead of an exact one, so any API path ending in "configs" skipped authentication — and since Kestra runs shell and Python scripts by default, that one line is unauthenticated root RCE. CISA confirms it's already being used for reverse shells and cryptomining.
CVE-2026-20079 lets an unauthenticated attacker get root on Cisco Secure Firewall Management Center, the box that manages your entire firewall fleet. CISA gave federal agencies one day to patch it.
SonicWall's SMA 1000 remote access gateways were hit by two separate unauthenticated RCE chains in 2026, both built on the same confused-deputy design flaw. Here's the kill chain, the ransomware fallout, and what it means if you run one of these boxes.