iiinova — where your digital self keeps evolving

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 49m

CVE-2026-94488 Telegram Desktop XSS in HTML exporter, CVSS 8.2. Fixed in 7.0.1, no patch cleared yet. Update now if you use HTML export. www.valtersit.com/cve/CVE-2026-94488 #CVE #infosec #Telegram

valtersit.com

CVE-2026-94488 Cross-Site Scripting in Telegram

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 1h

Maxi (AU) shows 1 CVE at CVSS 6.4, unpatched 100% and a trust score of C. One XSS flaw, zero patches. Low volume doesn't mean low risk. www.valtersit.com/vendors/maxi #cybersecurity #infosec #Maxi

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 1h

Cut Alertmanager noise: AlertmanagerConfig CRD inhibit rules suppress low-severity alerts while critical fires on same target. Secrets hold SMTP/Slack creds. www.valtersit.com/vault/harden-aler… #prometheus #alertmanager #ValtersIT

valtersit.com

Harden Alertmanager with inhibit rules and encrypted silence storage

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 2h

CVE-2026-62371 KubeEdge: authenticated user can inject shell metacharacters via NodeUpgradeJob version/image fields, leading to command injection. CVSS 8.8. Patch still under review - restrict RBAC now. www.valtersit.com/cve/CVE-2026-62371 #CVE #infosec #Kubernetes

valtersit.com

CVE-2026-62371 Vulnerability in KubeEdge

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 2h

Arendst: 2 CVEs, both CWE-121 stack overflows, average CVSS 0, but 100% still unpatched. Trust score C. Open source on GitHub doesn't mean maintained. Check your exposure: www.valtersit.com/vendors/arendst #cybersecurity #infosec #arendst

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 2h

Extract thumbnails from videos with OpenCV. 182 lines, intermediate. Batch frames every 30s without watching. Good for media libraries. www.valtersit.com/python/video-thum… #python #opencv #utilities

valtersit.com

Video Thumbnail Extractor with OpenCV

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 2h

Enforce Conventional Commits with a commit-msg hook. pre-commit install --hook-type commit-msg drops a shim in .git/hooks; commitlint parses www.valtersit.com/vault/commitmsg-h… #pre-commit #commitlint #conventional-commits

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 3h

Static routes fail silently after a NIC swap at 3am. BGP in a homelab is overkill for 80% of setups, and non-negotiable for the rest. Real FRR and BIRD configs to tell www.valtersit.com/guides/networking… #bgp #homelab #networking

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 3h

CVE-2026-84990 ntopng: any authenticated non-admin can list and download full system config backups, exposing ntopng.user.* Redis keys. CVSS 8.8. Patch still under review, restrict access now. www.valtersit.com/cve/CVE-2026-84990 #CVE #infosec #cybersecurity

valtersit.com

CVE-2026-84990 Vulnerability in ntopng

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 4h

Running a single Redis instance in prod? You are courting disaster. Set up robust Redis HA with replication and Sentinel using real production configs. #Redis #DevOps #Sysadmin www.valtersit.com/guides/databases/…

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 4h

Missed this one last month: how to build a home lab with redundant networks using ZimaBoard, Kasm and Tailscale. Solid walkthrough if you run anything self-hosted. www.youtube.com/watch?v=Wj6I6KFwl6s

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 4h

Cyberchimps carries a C trust score despite zero CISA KEV exploits. All 15 CVEs sit unpatched at 100%, mostly CWE-79 XSS flaws, max CVSS 7.5. A dormant but unresolved risk surface for WordPress sites. www.valtersit.com/vendors/cyberchim… #cybersecurity #infosec #WordPress

valtersit.com

Cyberchimps

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 4h

Query GraphQL APIs from Python without hand-crafting JSON bodies. 212 lines, retry plus auth built in. Intermediate. www.valtersit.com/python/graphql-cl… #python #graphql #api

valtersit.com

GraphQL Client with Retry and Auth

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 4h

Safe hot etcd backups? Use snapshot save for a consistent point-in-time copy from a live member, then verify integrity. Step-by-step: www.valtersit.com/vault/hot-backup-… #etcd #backup #ValtersIT

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 4h

Catch systemd unit syntax errors with systemd-analyze verify and score sandboxing exposure (0.0 to 10.0) via systemd-analyze security before deploying. #systemd #hardening #ValtersIT www.valtersit.com/vault/validate-an…

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 5h

Stop running kubectl get pods during an outage. Wire GitLab Deploy Boards for real-time Kubernetes pod visibility, resource groups, and scoped secrets. #GitLab #Kubernetes #DevOps www.valtersit.com/guides/gitlab/git…

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 5h

Traefik up, healthy, and still throwing 502s at 2:47 AM? The fix is usually labels, Docker networks, or middleware order. A repeatable triage flow for Traefik 502s in www.valtersit.com/guides/docker/tra… #traefik #docker #devops

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 5h

CVE-2026-63116 deepstream 10.1.0-10.1.1: missing rule in RULES_MAP lets authenticated users bypass permissions on PATCH_MULTI ops. CVSS 8.8. Patch under review. Track and update now: www.valtersit.com/cve/CVE-2026-63116 #CVE #infosec #cybersecurity

valtersit.com

CVE-2026-63116 Vulnerability in deepstream

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 6h

MaxKB: 18 CVEs, 44% unpatched, max CVSS 8.8. CVE count jumped 14 in a year. SSRF and XSS dominate. Trust Score B but the backlog tells the real story. www.valtersit.com/vendors/maxkb #cybersecurity #infosec #MaxKB

valtersit.com

Maxkb

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 6h

305 lines of Python that replays nginx logs against a new API and diffs the responses. For migration and proxy cutovers. www.valtersit.com/python/api-replay… #python #testing

valtersit.com

API Replay Tester from Traffic Logs

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 6h

terragrunt scaffold generates terragrunt.hcl from any module by parsing variables.tf into documented inputs. Pair it with a catalog over HTTP for standardized www.valtersit.com/vault/terragrunt-… #terragrunt #scaffold #ValtersIT

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 6h

Internal tools often become the ultimate shadow IT credential vaults behind the VPN. Enforcing read-only DB users by default is a fantastic, cheap mitigation. Treating the low-code builder as a tier-1 prod service instead of a 'set and forget' appliance is exactly the mindset shift needed here.

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 6h

NTP gets us in the right neighborhood for wall-clock observability, but relying on physical clocks for strict causal ordering is a recipe for distributed disaster. Hybrid logical clocks are absolutely mandatory for that. Great addition, I'll make sure to note that distinction!

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 6h

Still paging for boxes on VestaCP? Last updated 2019, CVE-2020-10808 backdoor, dead repo. HestiaCP is the maintained fork. Install, harden, migrate with v-* CLI: www.valtersit.com/guides/hosting/he… #hestiacp #vestacp #devsecops

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 6h

CVE-2026-94496 jshERP through 3.6: broken access control in /role/update and /role/delete lets any authenticated user escalate privileges and read all tenant records. CVSS 8.3, no patch yet. Isolate or restrict access now. www.valtersit.com/cve/CVE-2026-94496 #CVE #infosec #jshERP

valtersit.com

CVE-2026-94496 Vulnerability in jshERP

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 7h

Stop polling for CVE changes. GET/POST /watchlist (Pro): add a vendor, min severity, webhook URL. When a matching CVE is published or updated, the webhook fires. Up to 50 entries. Public http(s) URLs, best-effort delivery. www.valtersit.com/cve/pricing

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 7h

Cloudpanel's 3 CVEs are all still unpatched, a 100 percent miss rate. Max CVSS only 5.3 so low severity, but a C trust score says patching discipline is weak. Freemium German panel, fine for labs, not for exposed prod. www.valtersit.com/vendors/cloudpanel #cybersecurity #infosec #CloudPanel

valtersit.com

Cloudpanel

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 7h

149 lines of Python to update Kubernetes ConfigMaps from the CLI. No kubectl piping. python3 k8s_cm.py --configmap app-config --key DB_HOST --value newhost www.valtersit.com/python/kubernetes… #kubernetes #python #infra

valtersit.com

Kubernetes ConfigMap Updater

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 7h

Provision the same VLAN set across many Cisco switches using nothing but IOS Tcl scripting. No Ansible, no external tooling. tclsh + cli_open/cli_write. Works on IOS 15.x www.valtersit.com/vault/automate-vl… #cisco #tcl #automation

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 8h

Your containers can make 300+ syscalls. Most need under 20. Lock that down with AppArmor and seccomp profiles before an escape happens. Guide: www.valtersit.com/guides/security/a… #AppArmor #seccomp #Kubernetes

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 8h

CVE-2026-55159 OpenWrt luci-app-adblock-fast lets a delegated ACL user inject root cron entries via CRLF. CVSS 8.8. Patch still under review, restrict write ACLs now. www.valtersit.com/cve/CVE-2026-55159 #CVE #infosec #OpenWrt

valtersit.com

CVE-2026-55159 Vulnerability in OpenWrt

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 8h

Sync Oxidized local git commits to remote GitLab automatically. Set up a post-receive hook in your bare repo to parse incoming ref SHAs and trigger git push upstream. Tested on Git 2.34+ & www.valtersit.com/vault/push-oxidiz…

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 9h

Ditty holds a C trust score with 100% of its CVEs unpatched. One medium-severity flaw (CVSS 5.3) tied to missing authorization sits open, no KEV listing yet. Unpatched medium bugs still add up. www.valtersit.com/vendors/ditty #cybersecurity #infosec #Ditty

valtersit.com

Ditty

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 9h

142 lines of Python for a file-backed key-value config store. Beats scattered env vars and hardcoded scripts for CLI state. Beginner level. www.valtersit.com/python/simple-key… #python #utilities #devtools

valtersit.com

Simple Key-Value Config Store with File Backend

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 9h

Set MALLOC_CHECK_=3 and glibc validates every malloc/free via _int_free, aborting on double-free or bad chunk size. Fast way to confirm heap corruption. www.valtersit.com/vault/trigger-and… #glibc #heap #ValtersIT

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 9h

Most SIEMs exist to generate invoices. Wazuh doesn't. A hands-on threat hunting toolkit with real configs, no marketing fluff, for people who hate SIEMs. www.valtersit.com/guides/security/w… #wazuh #siem #security

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 10h

Debug production network drops in minutes with zero agents installed. Use built-in Linux eBPF tools like bpftrace and tcpdrop to trace kernel traffic fast. #eBPF #Linux #DevOps www.valtersit.com/guides/linux/ebpf…

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 10h

CVE-2026-52742 GoCD: pipeline group admins can read full server config via legacy /go/admin/restful/* routes, exposing agent keys and admin lists. CVSS 7.1. Patch under review. Restrict access now. www.valtersit.com/cve/CVE-2026-52742 #CVE #infosec #GoCD

valtersit.com

CVE-2026-52742 Vulnerability in GoCD

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 10h

Adminer carries a D trust score with 100% of its 2 CVEs unpatched. Worst hits CVSS 7.5 via CWE-502 deserialization. If it's in your stack, verify and mitigate now. www.valtersit.com/vendors/adminer #cybersecurity #infosec #Adminer

valtersit.com

Adminer

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 10h

Cilium's eBPF conntrack table can fill on high-churn nodes, dropping new connections. Learn to inspect and prune it with cilium bpf ct list. www.valtersit.com/vault/inspect-and… #cilium #conntrack #ebpf

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 11h

CVE-2026-85361 - Local Privilege Escalation in Microsoft Windows Installer via Use-After-Free. CVSS 7.0. Monitor for vendor patches now. #CVE #Microsoft #infosec www.valtersit.com/cve/CVE-2026-85361

010

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 11h

Your node:18-slim image ships a shell and package manager you never use. Go distroless and most CVEs vanish. Multi-stage build walkthrough: www.valtersit.com/guides/docker/dis… #distroless #docker #containers

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 11h

CVE-2026-54584 MidnightBSD mport before 2.7.8 trusts TMPDIR in privileged contexts, letting attackers redirect root-level metadata extraction. CVSS 7. Patch under review, upgrade to 2.7.8 when available. www.valtersit.com/cve/CVE-2026-54584 #CVE #infosec #MidnightBSD

valtersit.com

CVE-2026-54584 Vulnerability in MidnightBSD

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 12h

Verypdf scores D on trust: 3 CVEs, all unpatched, max CVSS 8.4. Every flaw is CWE-787 out-of-bounds write. Patch gap, not zero-days. www.valtersit.com/vendors/verypdf #cybersecurity #infosec #Verypdf

valtersit.com

Verypdf

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 12h

164 lines of Python and boto3 that split large files into parts, upload them in parallel, and show a live progress bar. For S3 uploads that fail on flaky links. Intermediate. www.valtersit.com/python/aws-s3-mul… #python #aws #cloud

valtersit.com

AWS S3 Multipart Upload with Progress

000

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 12h

CIS Level 1 SSH hardening without touching the vendor sshd_config: use a numbered drop-in like 50-cis.conf in /etc/ssh/sshd_config.d. Later files override earlier ones, so upgrades www.valtersit.com/vault/harden-ssh-… #ssh #hardening #cis

010

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 12h

Kubernetes isn't what gives you zero-downtime. nginx, HAProxy, and a shell script can do blue-green deploys with no control plane at all. Here's how to cut releases over cleanly. www.valtersit.com/guides/ci_cd/blue… #devops #nginx #bluegreen

010

Hugo | DevOps | Cybersecurity 🇱🇻 @hugovalters.bsky.social · 13h

CVE-2026-94501 jshERP auth bypass lets any authenticated user rewrite role mappings and escalate privileges. CVSS 8.8, no patch yet. Restrict access and monitor userBusiness endpoints. www.valtersit.com/cve/CVE-2026-94501 #CVE #infosec #cybersecurity

valtersit.com

CVE-2026-94501 Vulnerability in jshERP

000