Feed
Upwind Feed
Feed
Grid
Research
November 3, 2023
A New Deadly Combination in Nginx
Recently a deadly combination of vulnerabilities emerged, posing a severe threat to Kubernetes clusters utilizing Ingress-Nginx. By exploiting three critical vulnerabilities: attackers can execute arbitrary code and escalate privileges, all with access to the Nginx Annotation object. These vulnerabilities have been confirmed in both NGINX and Kubernetes/Ingress-Nginx, as reported by Google and various GitHub issues.…
October 25, 2023
Why Talking with Generative AI Might Be Dangerous
Large Language Models (LLMs) have emerged as game-changers in the rapidly evolving realm of artificial intelligence. While LLMs promise revolutionary capabilities such as analyzing vast datasets, mastering language nuances, and predicting user behavior, they also raise multiple security concerns that users should be aware of. Spotlight: LangChain, the MVP of LLM-Driven Applications LangChain is a…
October 6, 2023
Apache Pinot Vulnerability: Everything You Need to Know About the 900 Associated CVEs
During CVE research at Upwind, we encountered an unfamiliar Apache service known as Apache Pinot. Apache Pinot is a real-time distributed OnLine Analytical Processing (OLAP) datastore specifically designed to deliver low-latency responses to OLAP queries. The Apache Pinot architecture is comprised of four key components: Why Use Apache Pinot? Organizations implement Apache Pinot to enhance…
September 30, 2023
WebP Zero-Day: Everything You Need to Know About Libwebp
This month, the Citizen Lab at The University of Toronto's Munk School and Apple Security Engineering and Architecture (SEA) opened two critical vulnerabilities related to WebP images and Google’s webmproject/libwebp library. So, what is Libwebp? Libwebp is a commonly used library used to render WebP images. WebP is a modern image format that provides superior…
A New Deadly Combination in Nginx
Recently a deadly combination of vulnerabilities emerged, posing a severe threat to Kubernetes clusters utilizing Ingress-Nginx. By exploiting three critical vulnerabilities: attackers can execute arbitrary code and escalate privileges, all with access to the Nginx Annotation object. These vulnerabilities have been confirmed in both NGINX and Kubernetes/Ingress-Nginx, as reported by Google and various GitHub issues.…
Why Talking with Generative AI Might Be Dangerous
Large Language Models (LLMs) have emerged as game-changers in the rapidly evolving realm of artificial intelligence. While LLMs promise revolutionary capabilities such as analyzing vast datasets, mastering language nuances, and predicting user behavior, they also raise multiple security concerns that users should be aware of. Spotlight: LangChain, the MVP of LLM-Driven Applications LangChain is a…
Apache Pinot Vulnerability: Everything You Need to Know About the 900 Associated CVEs
During CVE research at Upwind, we encountered an unfamiliar Apache service known as Apache Pinot. Apache Pinot is a real-time distributed OnLine Analytical Processing (OLAP) datastore specifically designed to deliver low-latency responses to OLAP queries. The Apache Pinot architecture is comprised of four key components: Why Use Apache Pinot? Organizations implement Apache Pinot to enhance…
WebP Zero-Day: Everything You Need to Know About Libwebp
This month, the Citizen Lab at The University of Toronto's Munk School and Apple Security Engineering and Architecture (SEA) opened two critical vulnerabilities related to WebP images and Google’s webmproject/libwebp library. So, what is Libwebp? Libwebp is a commonly used library used to render WebP images. WebP is a modern image format that provides superior…