runZero Hour #20 is LIVE NOW - This is an amazing episode that includes Rishi & Sandeep of https://projectdiscovery.io/; here to give us the backstory on their company and the Nuclei open source vulnerability scanner (already bigger and more popular than Metasploit!). Hit our YT live stream to hear about PD, Nuclei, and how runZero is working with PD and the community on open source security tools!
home > posts
Hello Austin Gophers! The July ATX Go Meetup is TONIGHT (July 9th). The meetup includes lightning talks, pizza, beverages, and general discussion. Have a neat idea? A quick talk related to Go? Something to show-and-tell? https://www.meetup.com/atxgolang/events/305492502/
The weather outside is lousy, you might as well hang out in a conference room with us nerds! =D
I'm excited to announce our "Out-of-Band" series; these articles focus on the security risks of management devices like BMCs, serial servers, and IP-enabled KVMs. "Out-of-Band, Part 1: The new generation of IP KVMs and how to find them" is now live at:
https://www.runzero.com/blog/oob-p1-ip-kvm/Do you enjoy guzzling real-time TLS certificate allocations, but don't want to use a third-party service (crt.sh, CertStream, etc.)? Drink straight from the Certificate Transparency log firehose using ctail:
$ go run github.com/hdm/ctail@latest -f -m '^autodiscover\.'
A PSA for why you should probably not use Postman (it can leak secrets to them): https://anonymousdata.medium.com/postman-is-logging-all-your-secrets-and-environment-variables-9c316e92d424
Hello from BSides San Francisco! I'm excited to speak at 1:30pm in the AMC IMAX today. If you'd like to catch up afterwards, I'll be at the runZero booth first and at the City View lounge later. If you couldn't make the trip, the streaming links are live at https://www.youtube.com/@BSidesSF/streams
Hope to you see you there!
A few quick notes on the Erlang OTP SSHd RCE (CVE-2025-32433):
1. Cisco confirmed that ConfD and NSO products are affected (ports 830, 2022, and 2024 versus 22)
2. Signatures looking for clear-text channel open and exec calls will miss exploits that deliver the same payloads after the key exchange.
3. If you find a machine in your environment and can't disable the service, running the exploit with the payload `ssh:stop().` will shut down the SSH service temporarily.
Hello Austin Gophers! The ATX Go Meetup is THIS WEDNESDAY (April 9th). The meetup includes lightning talks, pizza, beverages, and general discussion. Have a neat idea? A quick talk related to Go? Something to show-and-tell? Running into a weird bug? Swing on by and hope to see you there! https://www.meetup.com/atxgolang/events/305492496/
Tired of using boring web browsers to manage your exposure with runZero? Nostalgic for the days of clean, MS-DOS terminal graphics? Ditch your modern trappings and visualize your network map using the best visualization tool of all time, ToneLoc:
Wondering how and why your vulnerability management tools are failing you? My talk
"Your Next Incident Won't Have a CVE" is now live at https://www.runzero.com/resources/your-next-incident-wont-have-a-cve/PS. runZero shipped coverage for Nutanix this week