Redis

API Token Lifecycle: From Issuance to Revocation and Secure Management

The article provides a comprehensive examination of the full API token lifecycle in browser-based applications, emphasizing that signatures alone cannot prevent token theft. It details risks introduced at issuance, storage, transmission, and revocation stages, including improper OAuth grant types and long-lived tokens. Key recommendations include short-lived access tokens, atomic refresh token rotation, and the use of Authorization Code Flow with PKCE for public clients. Storage advice strongly discourages localStorage and sessionStorage in favor of HttpOnly cookies or a Backend-for-Frontend pattern that keeps real tokens on the server. The piece also covers CSRF protections, rate limiting on authorization endpoints, and the advantages of signed client assertions over static secrets. Overall, it stresses that token security depends on the entire lifecycle architecture rather than cryptographic strength alone.

Exploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access

A detailed writeup published by Positive Technologies researcher Seven11eleven demonstrates a full attack chain against the vulnerable Messenger machine on the Standoff 365 platform. The researcher began with network reconnaissance using nmap and directory fuzzing with ffuf, uncovering Swagger documentation and JWT-protected endpoints. After identifying user enumeration through the friend search feature, the team discovered a Server-Side Template Injection flaw in the friendship summary functionality powered by the Mako template engine. The SSTI was escalated to remote code execution by injecting Python expressions that leveraged the self.module.cache.util chain to call os.popen commands. With initial access obtained via reverse shell, the attacker pivoted to neighboring services including Gitness, RabbitMQ, and Redis to achieve the defined business risks of accessing developer corporate messaging and extracting the city messenger encryption key.

Redis Patch Bypass Enables Multiple RCE Exploits as PoCs for TLS and Stream Vulnerabilities Go Public

Multiple remote code execution vulnerabilities have been disclosed in Redis over the past month, including a critical patch bypass for CVE-2026-25243 that reintroduces Double Free flaws via crafted stream operations. The latest issue, QVD-2026-58458 affecting the TLS pending list, now has full technical details and a working PoC available, following the earlier QVD-2026-55651 disclosure. All three flaws impact nearly every production version still in use, from Redis 6.2.22 and below through 7.4.9 and 8.6.4. Although authentication is required, widespread weak or empty password configurations and exposed instances make exploitation trivial for attackers. Successful compromise grants arbitrary code execution in the Redis process context, enabling standard post-exploitation steps such as credential harvesting and lateral movement across internal networks. Organizations are urged to inventory all instances, apply the latest patches immediately, restrict network access via ACLs, and monitor for anomalous use of commands like XGROUP, EVAL, and RESTORE.

OSINT for the Lazy Part 16: Discovering Hidden Corporate Infrastructure Through Shodan

The article explains how Shodan differs from traditional search engines by indexing internet-connected devices such as servers, routers, cameras, databases, and admin panels rather than web pages. It provides ten practical search techniques including hostname queries, SSL certificate searches, ASN lookups, IP range scans, and targeted queries for development environments, admin panels, and databases. Examples demonstrate how forgotten dev.company.com or staging.company.com hosts, open Jenkins or Grafana dashboards, and exposed MongoDB or Redis instances can be located with simple filters. The piece walks through a five-step real-world workflow that combines domain, SSL, organization, and service-title searches to map a target company’s infrastructure. It emphasizes that Shodan only reveals services already exposed to the internet and does not perform any exploitation. Common root causes listed include forgotten test servers, rushed DevOps configurations, and misconfigured firewalls. The article concludes with a reminder that many organizations remain unaware their internal systems are visible to anyone using the same techniques.

Mapping Logical Air Gap Techniques for Secure Network Segmentation

A detailed technical overview explores how organizations can achieve logical air gaps to isolate high-value network segments without completely severing data exchange. The article contrasts classic physical air gaps with everyday reverse proxies and introduces six distinct levels of isolation ranging from physical media to semantic validation. It evaluates each approach across three axes: whether a direct network path remains, which side initiates connections, and whether synchronous responses are possible. Practical constructions such as dual-homed hosts, message brokers, and schema-enforced proxies are examined alongside common misconceptions including reverse tunnels and port knocking. The guide emphasizes that true logical air gaps terminate sessions at an intermediary that then originates new, controlled exchanges. Real-world deployments typically combine multiple layers, such as network separation plus transport proxies plus content validation, to balance security and usability for critical environments like industrial control systems and backup repositories.

OAuth Authorization Server Built Without Storing User Profiles

The article details the evolution of an OAuth Authorization Server that deliberately avoids storing user profiles, relying instead on external identity providers for authentication. It addresses three core constraints: hundreds of dynamically created isolated APIs, a public SPA client without a BFF, and the inability of resources to query the AS on every request. The design separates concerns so the AS handles only clients, tenants, grants, audiences, scopes, keys, sessions, and token issuance while the Main API owns profiles and roles. Tokens are managed securely inside a Service Worker using a custom FedCM grant, eliminating races across tabs and reducing XSS exposure. The approach minimizes blast radius, simplifies compliance, and keeps the AS replaceable without affecting product domain logic.