Andre M. DiMino

MongoBleed (CVE-2025-14847) is basically Heartbleed for MongoDB - unauthenticated memory disclosure - public POC, trivial to exploit - leaks creds, tokens, cloud keys straight from RAM - huge exposed surface on the internet Good writeups and technical details here: doublepulsar.com/merry-chris… ox.security/blog/attackers-c… blog.ecapuano.com/p/hunting-… Patch fast, rotate secrets, and assume exposed instances were scanned(!)

People on here act like someone decides not to patch. Like there’s a guy who knows the service is vulnerable, knows it runs in prod, and just shrugs. That’s maybe 1% of the cases. The rest is messier: - No idea the service exists (no inventory) - No idea it’s vulnerable (no vuln reporting) - Afraid to break stuff (downtime, legacy crap) - No one owns it (silos, shadow IT) - No time (small team, constant firefighting) - Bad processes (manual patching, approvals, etc) - Patching tools suck (yep, that too) It’s rarely negligence. It’s usually chaos.

So, what just happened with the CVE program? - MITRE drops a letter saying funding ends tomorrow - Everyone panics, assumes no more CVE numbers - The community scrambles to organize - The CVE Foundation appears, positioned as a vendor-neutral non-profit - We all learn MITRE has 9,000 employees, $1.5B in funding, 16% in cybersecurity - MITRE clearly used this situation as a public pressure move - And it worked: CISA stepped in, extending the contract for another 11 months Meanwhile, ENISA is building its own EU vuln DB. Things are shifting. What did we learn from all this? - Trying to slim things down creates friction, and outrage is often used as a defense mechanism - But when there’s actual need, the private space will step in and fund it – that’s how markets work - And maybe, just maybe, this whole mess will lead to a more sustainable and efficient future for CVE Wouldn’t that be something.

Quinlan’s post hits the nail on the head - most SOC analysts are stuck doing monotonous work that’s far below their true potential. Watching endless alerts is mind-numbing; let’s be honest, a machine should do that. I totally agree with her point about the value of giving analysts the freedom to hunt. The real value of human analysts isn’t spotting a red dot in a sea of green - it’s taking those interesting highlights provided by algorithms and pivoting, exploring, and connecting the dots. That’s what humans are made for - curiosity, exploration, the thrill of the hunt (just like our ancestors chasing deer). In my view, SOCs of the future should leave repetitive, tedious monitoring tasks to automation and AI. Let’s let humans focus on the detective work, the creative stuff, the things that actually make the job exciting and meaningful. Great post. Totally resonated with me. linkedin.com/posts/quinnlanv…

I’ve trained many analysts over the years - inside my own teams, in SOCs, CERTs, and various internal security teams. And lately, I’ve been noticing a trend that deeply saddens me. There’s an increasing number of young professionals who struggle with the grind of our work. They get simple but necessary tasks - tasks that transform indicators, rework detections, or retrieve and process data - but they return flawed results, late and incomplete. Some even let AI do the work without checking if it's correct. And when I ask why, the answer, directly or indirectly, is often the same: "I want to do the exciting stuff." But the truth is, 97% of what we do in cybersecurity is not exciting. It's slow, repetitive, and requires patience. We grind through logs, extract data from reports, and refine rules. Most of the time, we don’t see the direct impact of our work. A signature written today might detect something crucial in a customer’s system six months from now, and we’ll never even know. But every small piece matters. What saddens me is not just the impatience, but the lack of care. The unwillingness to put thought and effort into something seemingly simple. The failure to reflect on how to make a task better. This goes against something deeply ingrained in my upbringing - a principle that I believe is also deeply rooted in both German and Japanese culture. In German, my grandmother would always say: "Mach es gescheit." It’s hard to translate precisely, but it means: Do it properly. Not just complete a task, but do it in a way that is solid, thoughtful, and more than just "good enough." It doesn’t mean perfection - it means putting care into what you do, even if no one else will notice. The Japanese have a similar philosophy, one that I greatly admire. There is a word, "shokunin" (職人精神), which means more than just "craftsman." It describes someone who dedicates themselves fully to their craft, always refining, always improving. Even in the smallest tasks, a shokunin finds a way to do things better, not because someone told them to, but because they take pride in their work. I was reminded of this when I thought about my uncle, who was a carpenter. When I was a child, I watched him finish his masterpiece for his final exam - an intricately crafted dresser. After days of sanding, polishing, and checking every tiny detail, he wasn’t done. He took out a small, hand-carved wooden rose, which he had made separately, and carefully placed it on the dresser’s ledge. It wasn’t required. No one had told him to add that ornament. But he did it because he cared. Because he wanted his work to be more than just acceptable. And this is what I want to see in young professionals today. It’s not about making flashy things, or chasing after excitement - it’s about taking pride in your craft, even in the smallest details. Because in the end, that’s what makes a difference. So my advice is this: Whatever you do, do it gescheit. Do it like a shokunin. Put care into your work, even if no one else will see it. That’s how you grow. That’s how you build trust. And in the long run, that’s what will set you apart.