CyberSpecScanning guides and CVE writeups
Practical writing on continuous scanning, triage, and compliance — aimed at the person who has to decide what to fix on Monday, not at a procurement committee.
Three themes run through everything here. Continuous scanning versus point-in-time assessment: what actually changes in the gap between annual pentests, and which of it matters. Prioritisation: why a CVSS number is an input to a decision rather than the decision itself, once exposure and blast radius are accounted for. And compliance in practice: what a control like SOC 2 CC6.1 requires from a technical team, stated plainly instead of quoted from the framework.
2 min read
Citrix underrated this NetScaler bug
CVE-2026-8452 shipped as a DoS fix in June. Researchers turned it into unauthenticated RCE in August, and attackers are now dropping web shells on it.
CVE-2026-8452 · Remote Code Execution · Edge Devices · Patch Management · Vulnerability Management
3 min read
Authenticated vs unauthenticated scanning
One scan tells you what an outsider can reach. The other tells you what is installed. Swapping the two is how a finding list stops matching reality.
Vulnerability Management · Network Scanning · External Scanning · Patch Management
3 min read
Cyber Essentials: what the scan has to pass
The five controls are the paperwork. For Cyber Essentials Plus, an assessor scans your internet-facing addresses and one number decides the result.
Cyber Essentials · Compliance · Patch Management · External Scanning
3 min read
Subdomain takeover: the dangling DNS record
A CNAME outliving the service it pointed at is not a broken link. It is an unclaimed name on your domain that somebody else can register.
Attack Surface · DNS · Subdomain Takeover · Asset Discovery
2 min read
EPSS vs CVSS: which number sorts the queue
CVSS says how bad a vulnerability could be. EPSS estimates whether anyone will actually use it. They answer different questions.
EPSS · CVSS · Vulnerability Prioritisation · Patch Management
2 min read
PCI DSS 11.3.2: what ASV scanning requires
External scans every three months, from an Approved Scanning Vendor, with a passing result. Here is what each of those three constraints costs you.
PCI DSS · ASV Scanning · Compliance · External Scanning
2 min read
What counts as your external attack surface
It is never the list in your asset inventory. It is whatever answers on a public address today, including the things nobody remembers standing up.
Attack Surface · Asset Discovery · Shadow IT · External Scanning
2 min read
ISO 27001 A.8.8: what auditors ask to see
The control is four lines long. What an auditor wants is the record proving you followed it, and that is where most programmes come apart.
ISO 27001 · Compliance · Vulnerability Management · Annex A
2 min read
Ports that should never face the internet
RDP, database ports and container control planes end up publicly reachable the same handful of ways — almost never by decision.
Network Scanning · Attack Surface · Exposed Services · Port Scanning
2 min read
wp2shell: unauthenticated RCE in WordPress
CVE-2026-63030 chains a REST API batch-processing flaw with an SQL injection to mint an admin account. No credentials required.
WordPress · CVE-2026-63030 · Remote Code Execution · REST API · Web Application Security
2 min read
Patching SharePoint does not evict the intruder
The 2026 on-prem SharePoint exploit chain steals IIS machine keys. Patch, hunt, then rotate — in that order, or the attacker keeps their access.
SharePoint · CVE-2026-56164 · Machine Keys · Incident Response · Persistence
2 min read
The VPN flaw that skipped the login screen
CVE-2026-50751 lets an unauthenticated attacker forge IKEv1 auth flags and land inside the network. Four affected branches will never get a patch.
VPN Security · CVE-2026-50751 · Authentication Bypass · Edge Devices · Ransomware
2 min read
SOC 2 CC6.1: what logical access controls need
The control family shows up on every SOC 2 report. Here's what an auditor is actually checking for.
SOC 2 · Compliance · Access Control
2 min read
CVSS score alone is not a priority order
A 9.1 on an internal dev box and a 7.4 on your public API gateway are not the same problem.
CVSS · Triage · Vulnerability Management
2 min read
Why annual pentests miss what matters
A point-in-time assessment can only ever tell you about the point in time it ran. Here's what changes in the gap.
Penetration Testing · Continuous Scanning · Security Operations
