RabbitMQ

redb 4.0 Released: XML Routes, Lazy References, Unique Keys and WS-Trust Across the Ecosystem

The redb ecosystem has delivered a major simultaneous release across all core components, bringing redb.Core, redb.Route, redb.Tsak and redb.Identity to version 4.0.0. The update introduces declarative XML routing, lazy object references, unique key constraints, and a full WS-Trust SOAP facade while closing multiple security issues reported through external audits and community feedback. Seventy-six NuGet packages, seven container images and platform archives for Windows and Linux are now available, with the Pro edition remaining free and license-free throughout the 4.x line. Significant internal changes include a unified expression language, support for modern data formats such as Protobuf and Avro, and improved handling of distributed caches and OpenTelemetry metrics. Security hardening covers header sanitization in all identity facades, consent-page protections, dashboard access controls and a switch to bcrypt password hashing. Existing clusters must be stopped before upgrade because mixed versions are not supported, and large databases require a maintenance window for schema changes and partial index creation.

Exploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access

A detailed writeup published by Positive Technologies researcher Seven11eleven demonstrates a full attack chain against the vulnerable Messenger machine on the Standoff 365 platform. The researcher began with network reconnaissance using nmap and directory fuzzing with ffuf, uncovering Swagger documentation and JWT-protected endpoints. After identifying user enumeration through the friend search feature, the team discovered a Server-Side Template Injection flaw in the friendship summary functionality powered by the Mako template engine. The SSTI was escalated to remote code execution by injecting Python expressions that leveraged the self.module.cache.util chain to call os.popen commands. With initial access obtained via reverse shell, the attacker pivoted to neighboring services including Gitness, RabbitMQ, and Redis to achieve the defined business risks of accessing developer corporate messaging and extracting the city messenger encryption key.

Mapping Logical Air Gap Techniques for Secure Network Segmentation

A detailed technical overview explores how organizations can achieve logical air gaps to isolate high-value network segments without completely severing data exchange. The article contrasts classic physical air gaps with everyday reverse proxies and introduces six distinct levels of isolation ranging from physical media to semantic validation. It evaluates each approach across three axes: whether a direct network path remains, which side initiates connections, and whether synchronous responses are possible. Practical constructions such as dual-homed hosts, message brokers, and schema-enforced proxies are examined alongside common misconceptions including reverse tunnels and port knocking. The guide emphasizes that true logical air gaps terminate sessions at an intermediary that then originates new, controlled exchanges. Real-world deployments typically combine multiple layers, such as network separation plus transport proxies plus content validation, to balance security and usability for critical environments like industrial control systems and backup repositories.