Why UFW Fails Against Docker: Anatomy of Network Bypass and Bot Exploitation of Exposed Database Ports

New Container, Old Code: Why the Incident Returned After Three Months

Two 1C-Bitrix sites shared the same web shell WebShellOrb after an attacker exploited multiple vulnerabilities in a legacy self-written application called appeal. The initial compromise occurred via an unauthenticated SQL injection in AppealModel::getReportData combined with JWT authentication bypass and hardcoded secrets. Logs were retained for only one month, so investigators could not trace the entry point and incorrectly concluded there was no persistence after restarting the container. The shared filesystem and single system user allowed the shell to be copied to the second site, while password hashes remained extractable through API methods. Even after password changes and container redeployment, the attacker regained access weeks later because the JWT secret, code flaws, and common storage were never addressed. The case demonstrates that redeploying containers without fixing root vulnerabilities in legacy code leaves systems exposed for months.

Ginux Rust Kernel Receives Security Fixes in 10 Hours While Linux Patch Takes 69 Days to Reach Mainline

A researcher identified multiple vulnerabilities in both the experimental Ginux Rust-based kernel and the upstream Linux kernel, revealing stark differences in development velocity. In Ginux, 15 issues were reported via GitHub, with the first three fixes merged into main within 10 hours and a critical TLS RNG flaw resolved in 12 hours. The Linux kernel patch for Android Binder required 69 days to reach Linus Torvalds' tree after initial submission, despite early review within 11 days. Ginux, created by Rocky Linux founder Gregory Kurtzer, uses AI agents for rapid patching while Linux follows traditional maintainer and release-cycle processes. The researcher used multiple AI models for threat modeling and adversarial verification before submitting PoCs reproduced in QEMU. The findings highlight how agent-driven development can accelerate security response compared to established kernel workflows.

OneDrive and SharePoint URLs Enable Corporate Username Enumeration, Microsoft Calls Risk Low

Attackers can discover valid corporate User Principal Names by probing OneDrive and SharePoint URLs without triggering authentication logs. Microsoft acknowledges the reconnaissance technique but classifies it as low severity because a discovered login alone does not bypass multi-factor authentication. The method leaves no traces in Microsoft Entra ID or Microsoft Purview audit logs, and organizations receive no alerts when usernames are enumerated this way. Microsoft limits bulk requests against non-existent OneDrive sites yet does not fully block the enumeration vector. The company recommends organizations rely on conditional access policies, phishing-resistant MFA, and sign-in risk protections to prevent follow-on attacks such as password spraying or targeted phishing. The issue primarily affects small and medium businesses as well as enterprises using Microsoft 365.