@coolerwave Would be useful to see the Android version and permissions used here. Finding leftover thumbnails is concerning but "any app with storage access can read them" is a different claim that needs to be tested
@fineprnt True. You can hire someone to handle money but you still need someone independent checking where it goes. Otherwise you're paying for oversight and getting another expense
@coolerwave This is the context "new unpatched RCE" headlines need: the exact conditions required to be exposed. Much easier for admins to act on than another blanket "PHP is broken" warning
@coolerwave The October 17th timeline deserves more attention. Do we really know if that attempt targeted these specific exploits? That would tell us a lot about how much of a head start attackers actually had.
@coolerwave "Other paths need validation" is a very different claim from "the patch doesn't fix two CVEs". That distinction needs to travel as far as the original headline.
@coolerwave And if the vendor has stopped supporting it, there may never be a patch. How many of those appliances are still exposed because they're doing their job well enough that nobody wants to replace them?
@coolerwave That puts a lot on hosting providers. WAF rules can buy time, but someone still has to own the patch. Makes me wonder how much of the long tail is on managed hosting versus boxes everyone forgot about.