Discussions, questions and news about Trivy from cybersecurity professionals on Cyberr.
0 members · 11 posts
samuel watua Soita — Full Stack Software Engineer
One malicious package can turn a developer tool into a credential-harvesting machine. That's exactly why software supply-chain security deserves much more attention. Microsoft recently analyzed the LiteLLM 1.107.0 supply-chain compromise, where attackers used stolen developer to…
· 0 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
A vulnerability doesn't have to be complicated to become dangerous. It just needs to reach the right server. The cybersecurity community is currently dealing with PHP2Shell — two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 CVSS v4.0 and…
· 2 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit.sh v4.8.2: check 30 expanded from 8 → 26 RBAC probes, closing every gap we identified: * Escalation self-grant: escalate on roles/clusterroles, plus create clusterrolebindings and create rolebindings alongside the existing bind. * Full impersonation set: i…
· 3 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit.sh — recent updates (v4.7.9) A quick update on the read-only container-escape and privilege-escalation auditor for Linux and Kubernetes nodes — a single Bash script, no dependencies, makes zero changes to the host it runs on. The last few releases have pus…
· 3 reactions · 0 comments
Haydn Kuti — Lead Community Operator
BSides Maine: Community, Malware, and Identity Residue Spent an awesome day volunteering and connecting at the inaugural BSides Maine. Taking part as an auditorium logistics volunteer was a fantastic experience, and the event brought together an incredible mix of technical depth…
· 2 reactions · 4 comments
Om S. — CyberSecurity Research Engineer
Hot take: AI didn't kill bug bounty hunting. It just exposed who was actually good at it. ------ Here's what nobody says out loud — The lazy ones used AI. Copy pasted the output. Hit submit. No verification. No proof of concept. Just confidence. 70% of those reports? Invalid. --…
· 2 reactions · 0 comments
Innocent O. Akpareva — Cybersecurity Analyst
Vulnerability Management with Nessus Vulnerability Scanner Here's exactly what I did, step by step. Everything is on video, which I will be dropping on my YouTube channel today. Subscribe and turn on notifications here: https://youtube.com/drillerbyte?sub_confirmation=1 Step 1:…
· 5 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
Just released an open-source bash checker for CIFSwitch (CVE-2026-46243) — the 19-year-old Linux kernel LPE disclosed last week that lets any unprivileged local user get root by abusing the CIFS/SPNEGO upcall path. The script runs on bare-metal, VMs, and inside containers, and i…
· 2 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
ARM is everywhere in the cloud now — and this month brought a reminder of what that means for isolation. ITScape (CVE-2026-46316) is, as far as anyone publicly knows, the first guest-to-host escape targeting KVM/arm64. It's a use-after-free deep in the kernel's vGIC-ITS interrup…
· 1 reactions · 0 comments
André Ataíde — Systems Analyst – Supply Chain & ML Security
Software release decisions tend to leave no trail. The scanner ran, flagged something, someone decided to act (or not), but that decision got lost in a Slack thread, in a call, or ended up somewhere that doesn't survive an audit. It's a pattern that repeats everywhere, for the m…
· 0 reactions · 0 comments
Innocent O. Akpareva — Cybersecurity Analyst
📢 Shared from CyberShift Hot take… A lot of people learning cybersecurity (including me at some point) get stuck just watching tutorials and collecting certificates. Nothing wrong with that, but the real test is when you actually have to do the work. Can you spot an attack? Can…
· 0 reactions · 0 comments