Product.
Security.
Operations.
Perspectives on application security, cloud risk and the operational work of protecting digital services.
CVE-2026-71309: Technical Analysis of the Root Escape in rclone serve restic
A technical analysis of CVE-2026-71309, a path traversal in rclone's restic-compatible REST server (rclone serve restic). A URL path starting with ../ could escape the operator's published root and read, create, overwrite, or delete objects outside it, depending on the storage backend. We break down the root cause (treating path canonicalization as containment), why the outcome depended on the backend, how exploitation worked, and the fix in rclone 1.75.0.
What Is an Attack Surface and Why Does Your External Inventory Age Every Day?
A practical guide to understanding internet-facing assets, ownership drift, discovery gaps, and the operational case for continuous visibility.
From DNS to Exposed Services: Mapping an External Attack Surface with Verifiable Evidence
A technical workflow for turning domains, certificates, services, technologies, and exposures into evidence-backed attack-surface findings.
Surface Drift Index: A Vorpsel Method for Measuring Continuous Exposure
A transparent model for combining asset churn, severity, persistence, ownership confidence, and remediation delay into one directional metric.