When a backup server becomes an entry point
CVE-2026-105133CVE-2026-105134Huntress observed webshells and XMRig following AhsayCBS exploitation. The vendor released hotfixes; its updated advisory identifies the applicable version branches.
INVESTIGATION LABTRACES · MECHANISMS · EVIDENCE
READ THE INCIDENT. UNDERSTAND THE BOUNDARY.
Trace the unexpected.
From recently documented incidents to a model you can verify yourself. Read the evidence, separate known facts from hypotheses, and see how a policy changes system behavior.
~/lab / case index
> read reviewed case files
03 sourced briefs / 01 interactive model
choose a trace. test an assumption.
INSIDE SHADOWDEV
Real observations. Bounded conclusions.
Two decisions from this codebase and its review. What changed, what was measured, and what remains unproven.
Does less JavaScript guarantee a faster paint?
The earlier home page initialized 3D immediately. I removed the decorative workload, separated article loading from the first screen, and compared the production versions under the same measurement configuration.
Home JavaScript358 214 KiB
About 40% less script transfer.
Largest Contentful Paint844 1068 ms
No improvement in this sample.
The defensible conclusion is reduced initial JavaScript and GPU work. It does not prove a faster experience on a real network: artwork and layout also changed, and the real database connection remains unverified.
Measurements at the 3D-removal checkpoint, before adding this note: median of 3 runs, production, 390 × 844 viewport, cold cache, configured 1.6 Mbps / 150 ms network and 4× CPU slowdown. These are not field measurements.
INCIDENT FILES / REVIEWED 18 OCT 2026
Reference files from recent incidents.
Recent reports from vendors and first-hand research teams. Each file keeps its source, publication or update date, and a question for deeper analysis.
Two broken boundaries at the network edge
CVE-2026-88771CVE-2026-88772Citrix confirmed observed exploitation on unmitigated NetScaler deployments. The conditions differ: one flaw involves input validation; the other involves memory handling with DTLS enabled.
Open the analysis angle
A QUESTION FROM SHADOWDEV
Which appliances meet the actual conditions, beyond sharing a product name?
Check the original report
Citrix · CTX697096A file-reading API crosses its intended boundary
CVE-2026-85706GitLab documented path confinement and authentication failures in the repository commits API, and noted KEV inclusion. Its September 10 bulletin was updated September 23 with backported fixes.
Open the analysis angle
A QUESTION FROM SHADOWDEV
Where is the boundary between a caller-supplied path and a server-side file enforced?
Check the original report
GitLabThese are manually selected, sourced summaries. The interactive case below is a separate learning model, not a reconstruction of these attacks.
VERIFY IT YOURSELF / CASE 001
A valid session is not enough.
Observe the request, choose a policy, and run the checks. This case focuses on permission to read a user’s private record.
CASE FILE 001
Simulated data · Local executionA successful response. A missing boundary.
A signed-in user can read someone else’s private note. Find the evidence, choose where to fix the problem, and verify the new behavior.
Which line raises a question?
Select a trace to inspect its context. A 200 status is only the beginning.
This model uses fictional data and runs checks in your browser. It covers private, single-owner notes; real systems also need policies for roles, teams, and individual actions. Reference: OWASP API1 ↗