Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Pure conjecture. But let’s say solar winds is using a known popular build server, and this build server was only ever going to be accessed by internal resources and employees.

Then let’s say this build server had an unusually high usage of build plugins. And the upgrading of that product was difficult and sometimes troublesome because of these custom plugins and their interdependencies. And so they at some point they missed an upgrade or two on accident, or because upgrading is hard.

Now they are running an build server with several know vulnerabilities. But because that build server isn’t public. It’s really no big deal that it’s a bit out of date. Until it is.



Ah, it was the butler - in the server room - with the ethernet cable.

(Come to think of it, security Cluedo would be quite fun ...)


Let me guess, was there a certain butler involved?


And said build server application has 150 CVEs, and if people get lazy will provide shells to unauthenticated web users:

https://www.cvedetails.com/vulnerability-list/vendor_id-1586...


That sounds very interesting and frightening at the same time.

Could it be that there are more companies out there in a kind of similar situation? It would be quite bad of course if such information would become widely know I could imagine.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: