Sometimes, they really are just stupid
Every time I hear “user X is an idiot” I typically have a conversation like “user X doesn’t have your technical background, that doesn’t mean they are stupid” or “if it wasn’t for people like user X I wouldn’t need your talent” etc.
Naturally I think this too every now and then and have to remind myself of the same thing.
Today, I was listening to an audiobook of 1984 when a user walks in my office. Never mind that my door was closed and I was working on a confidential document, I lock my screen and then pause the book and he says, “That sounded good, what is that?”
I said that it was an audiobook of 1984.
He says, “Is there any way you can send me a trannoscript of that?”
I said what do you mean, a trannoscript?
He says, “Well I don’t like listening to podcasts, but if it’s interesting, I’ll read the trannoscript of it.”
I said you want me to send you a trannoscript of *the book* 1984. He says, “Yes..”
I stared at him for at least five seconds thinking surely it would click and finally I just said sorry, what did you actually need help with and moved on with my life.
I could understand if it was some obscure novel or if I hadn’t said the word *book* a couple times, but this was a first-person experience of some next-level stupidity.
https://redd.it/1puvd85
@r_systemadmin
Every time I hear “user X is an idiot” I typically have a conversation like “user X doesn’t have your technical background, that doesn’t mean they are stupid” or “if it wasn’t for people like user X I wouldn’t need your talent” etc.
Naturally I think this too every now and then and have to remind myself of the same thing.
Today, I was listening to an audiobook of 1984 when a user walks in my office. Never mind that my door was closed and I was working on a confidential document, I lock my screen and then pause the book and he says, “That sounded good, what is that?”
I said that it was an audiobook of 1984.
He says, “Is there any way you can send me a trannoscript of that?”
I said what do you mean, a trannoscript?
He says, “Well I don’t like listening to podcasts, but if it’s interesting, I’ll read the trannoscript of it.”
I said you want me to send you a trannoscript of *the book* 1984. He says, “Yes..”
I stared at him for at least five seconds thinking surely it would click and finally I just said sorry, what did you actually need help with and moved on with my life.
I could understand if it was some obscure novel or if I hadn’t said the word *book* a couple times, but this was a first-person experience of some next-level stupidity.
https://redd.it/1puvd85
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Pouring one out for the Steam sysadmins on call today
They must have at least a few people who work over the holiday there right?
Clearly they are dealing with some issue. Both downdector and steamstat.us are showing signs of a large outage. Anecdotally the store and partner portal have been acting up for myself for about an hour.
https://redd.it/1puxovk
@r_systemadmin
They must have at least a few people who work over the holiday there right?
Clearly they are dealing with some issue. Both downdector and steamstat.us are showing signs of a large outage. Anecdotally the store and partner portal have been acting up for myself for about an hour.
https://redd.it/1puxovk
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
When you did V2V from VMware to Hyper-V what tools did you use?
Can anyone please tell me a detailed guide preferably for moving 180 Vms from vmware vcenter 8.0 onto hyper-v.
What tools, what methods for V2V did you use?
Details would be appreciated. As for Vms with static IP sql servers how did you move those?
https://redd.it/1pv3u7u
@r_systemadmin
Can anyone please tell me a detailed guide preferably for moving 180 Vms from vmware vcenter 8.0 onto hyper-v.
What tools, what methods for V2V did you use?
Details would be appreciated. As for Vms with static IP sql servers how did you move those?
https://redd.it/1pv3u7u
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
How do you guys train the trainable classifiers for CUI?
So I'm trying to set up a DLP + label + trainable classifiers at my work. We are in Microsoft GCCHIGH environment with no on-prem.
I have tried many times to train the trainable classifers "CUI" to work, but since we do not have a actual CUI documents to work with, it keeps failing. Looks like we need at least 50 positive and 50 negative minimum. I tried generating some fake positive CUI and negatives but it failed...
Any sysadmins or Information Protection Engineers in CMMC space, how did you guys set up the trainable classifiers without using an actual CUI documents?
https://redd.it/1pv4psg
@r_systemadmin
So I'm trying to set up a DLP + label + trainable classifiers at my work. We are in Microsoft GCCHIGH environment with no on-prem.
I have tried many times to train the trainable classifers "CUI" to work, but since we do not have a actual CUI documents to work with, it keeps failing. Looks like we need at least 50 positive and 50 negative minimum. I tried generating some fake positive CUI and negatives but it failed...
Any sysadmins or Information Protection Engineers in CMMC space, how did you guys set up the trainable classifiers without using an actual CUI documents?
https://redd.it/1pv4psg
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Spent 6 months building a service mesh just to add retry logic
Our microservices architecture kept having issues with services timing out when talking to each other. Network blips, services restarting, the usual distributed systems problems.
Our architect decided we needed a full service mesh, spent half a year implementing Istio and learning a whole new set of concepts. As a team of 4 people we basically did nothing else. Finally got it working, services can now retry failed requests automatically. Also got distributed tracing and some traffic shaping we don't use.
Then I found out our competitor solved the same problem in 2 weeks by just switching their internal communication to a different protocol that handles reconnects natively. Their services just work even when networks hiccup.
We now have this massive infrastructure to maintain. Need to understand envoy configs, debug sidecar issues, deal with version compatibility. One person's entire job is just keeping the mesh working. Not saying service mesh is always wrong but maybe exhaust simpler options first. We could've tried connection pooling, better timeouts, or just picking better tools for service communication. Instead we went big from the start and now we're stuck with it.
https://redd.it/1pv6x3z
@r_systemadmin
Our microservices architecture kept having issues with services timing out when talking to each other. Network blips, services restarting, the usual distributed systems problems.
Our architect decided we needed a full service mesh, spent half a year implementing Istio and learning a whole new set of concepts. As a team of 4 people we basically did nothing else. Finally got it working, services can now retry failed requests automatically. Also got distributed tracing and some traffic shaping we don't use.
Then I found out our competitor solved the same problem in 2 weeks by just switching their internal communication to a different protocol that handles reconnects natively. Their services just work even when networks hiccup.
We now have this massive infrastructure to maintain. Need to understand envoy configs, debug sidecar issues, deal with version compatibility. One person's entire job is just keeping the mesh working. Not saying service mesh is always wrong but maybe exhaust simpler options first. We could've tried connection pooling, better timeouts, or just picking better tools for service communication. Instead we went big from the start and now we're stuck with it.
https://redd.it/1pv6x3z
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
So what has AI done for you?
In between all the concerns and hate, has AI solved a problem for anyone they couldn't have solved without it?
I made the switch to IT fairly recently so it's been a great help for noscripting. I instruct it to train me and not just give code, so I don't necessarily go faster but at least I actually learn, and it's great for code review at that level.
But apart from a personal assistant, what can it really do for us in its current state?
https://redd.it/1pv8o8f
@r_systemadmin
In between all the concerns and hate, has AI solved a problem for anyone they couldn't have solved without it?
I made the switch to IT fairly recently so it's been a great help for noscripting. I instruct it to train me and not just give code, so I don't necessarily go faster but at least I actually learn, and it's great for code review at that level.
But apart from a personal assistant, what can it really do for us in its current state?
https://redd.it/1pv8o8f
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Thickheaded Thursday - December 25, 2025
Howdy, /r/sysadmin!
It's that time of the week, Thickheaded Thursday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!
https://redd.it/1pva79d
@r_systemadmin
Howdy, /r/sysadmin!
It's that time of the week, Thickheaded Thursday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!
https://redd.it/1pva79d
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Merry Christmas to all on-call & on-site today
From someone on-site today, may the phones, emails and apps stay quiet today
https://redd.it/1pvd451
@r_systemadmin
From someone on-site today, may the phones, emails and apps stay quiet today
https://redd.it/1pvd451
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
When did you fix something, but you're not really sure why it worked?
It was back when I was VERY junior and working as a lab assistant in a college computer lab in the mid 90s. We'd just gotten on the internet so we had to re-ip everything (NAT wasn't a thing yet, each workstation had a real IP on the internet). The guy who ran the lab re-ip'd our SunOS workstations, and the next day, only one of them worked, the rest did not. For what it's worth the one that worked had it's own disk, the ones that did not were diskless and booted over the network via TFTP.
Being very green and having a couple of years of computer science under my belt, I started poking around and found a directory with a bunch of hexadecimal named files. Having seen hex many times I noticed that the numbers in the filenames were the same as the old IP addresses. So I copied them to a bunch of new files with the new IPs. I rebooted a dead workstation and it came to life, so I did the rest!
I now know why it worked, having learned it all since, but at the time I was still very unsure how I got it to work, just that making some of the numbers match up did the trick.
https://redd.it/1pvg3qw
@r_systemadmin
It was back when I was VERY junior and working as a lab assistant in a college computer lab in the mid 90s. We'd just gotten on the internet so we had to re-ip everything (NAT wasn't a thing yet, each workstation had a real IP on the internet). The guy who ran the lab re-ip'd our SunOS workstations, and the next day, only one of them worked, the rest did not. For what it's worth the one that worked had it's own disk, the ones that did not were diskless and booted over the network via TFTP.
Being very green and having a couple of years of computer science under my belt, I started poking around and found a directory with a bunch of hexadecimal named files. Having seen hex many times I noticed that the numbers in the filenames were the same as the old IP addresses. So I copied them to a bunch of new files with the new IPs. I rebooted a dead workstation and it came to life, so I did the rest!
I now know why it worked, having learned it all since, but at the time I was still very unsure how I got it to work, just that making some of the numbers match up did the trick.
https://redd.it/1pvg3qw
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Microsoft Authenticator App
Recently I’ve been getting login attempt notifications in the Microsoft Authenticator app, which got me all paranoid because I thought you had to know the password before it will prompt for MFA.
However, if you go to Microsoft and login with your email. It will prompt you for the app, bypassing the password entirely.
I realize I still need to select the proper number presented in the app to grant login, but can anyone explain to me how this isn’t a step backwards in security?
P.S. I’m not looking for tech support. I’m hoping to discuss this passwordless login method to see why it’s supposed to be a cybersecurity improvement. It doesn’t make sense to me.
https://redd.it/1pvjywa
@r_systemadmin
Recently I’ve been getting login attempt notifications in the Microsoft Authenticator app, which got me all paranoid because I thought you had to know the password before it will prompt for MFA.
However, if you go to Microsoft and login with your email. It will prompt you for the app, bypassing the password entirely.
I realize I still need to select the proper number presented in the app to grant login, but can anyone explain to me how this isn’t a step backwards in security?
P.S. I’m not looking for tech support. I’m hoping to discuss this passwordless login method to see why it’s supposed to be a cybersecurity improvement. It doesn’t make sense to me.
https://redd.it/1pvjywa
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Fortigate vs Sonicwall
My company is currently using a Sonicwall and Aruba switches. I am set to replace it first half of 2026 along with a few switches (will be updating switches in waves). I have years of experience with both but wanted to hear some opinions on which you all prefer and why? I like and dislike things on both.
I am leaning towards going full on Fortigate with firewall and switches.
https://redd.it/1pvmnz1
@r_systemadmin
My company is currently using a Sonicwall and Aruba switches. I am set to replace it first half of 2026 along with a few switches (will be updating switches in waves). I have years of experience with both but wanted to hear some opinions on which you all prefer and why? I like and dislike things on both.
I am leaning towards going full on Fortigate with firewall and switches.
https://redd.it/1pvmnz1
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
unsafe-inline - how bad is it?
My devs unfortunately used inline noscripts a few times and so I have had to keep that in the nginx under Content-Security-Policy,
is that fine?
https://redd.it/1pvowbh
@r_systemadmin
My devs unfortunately used inline noscripts a few times and so I have had to keep that in the nginx under Content-Security-Policy,
is that fine?
https://redd.it/1pvowbh
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Why IPv6 costs more to deploy with GCP and Vercel?
GCP shop plus Vercel.
GCP supports IPv6 networking in the premium tier only - https://docs.cloud.google.com/vpc/docs/ipv6-support
which is a lot more expensive.
Doing IPv6 on the edge load balancers and the rest with NAT64 is possible, but annoying as dual-stack would be easier.
Vercel says not to front itself with anything - https://vercel.com/kb/guide/cloudflare-with-vercel
But it also does not support IPv6. So one has to front it with Cloud flare to get IPv6 or something like that.
Are there any alternatives?
Why is it more expensive?
How to enable IPv6 for external clients without incurring huge costs - especially since all dual-stack clients might be preffering IPv6.
https://redd.it/1pvtuvr
@r_systemadmin
GCP shop plus Vercel.
GCP supports IPv6 networking in the premium tier only - https://docs.cloud.google.com/vpc/docs/ipv6-support
which is a lot more expensive.
Doing IPv6 on the edge load balancers and the rest with NAT64 is possible, but annoying as dual-stack would be easier.
Vercel says not to front itself with anything - https://vercel.com/kb/guide/cloudflare-with-vercel
But it also does not support IPv6. So one has to front it with Cloud flare to get IPv6 or something like that.
Are there any alternatives?
Why is it more expensive?
How to enable IPv6 for external clients without incurring huge costs - especially since all dual-stack clients might be preffering IPv6.
https://redd.it/1pvtuvr
@r_systemadmin
Google Cloud Documentation
IPv6 support in Google Cloud | Virtual Private Cloud | Google Cloud Documentation
sharemouse alternative that supports linux != synergy
i use Sharemouse pretty much since day 1, the company basically picked up the synergy code and made it work, and this lasts until today, the software is clearly superior to the original, and well worth the price, however them being german, support usually turns into a ego nightmare, and well they have no linux client. synergy is still trash (especially on OSX)
anyone knows somethings that runs primary on OSX and Linux and has "some" windows support?
https://redd.it/1pvyeb2
@r_systemadmin
i use Sharemouse pretty much since day 1, the company basically picked up the synergy code and made it work, and this lasts until today, the software is clearly superior to the original, and well worth the price, however them being german, support usually turns into a ego nightmare, and well they have no linux client. synergy is still trash (especially on OSX)
anyone knows somethings that runs primary on OSX and Linux and has "some" windows support?
https://redd.it/1pvyeb2
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Weekly 'I made a useful thing' Thread - December 26, 2025
There is a great deal of user-generated content out there, from noscripts and software to tutorials and videos, but we've generally tried to keep that off of the front page due to the volume and as a result of community feedback. There's also a great deal of content out there that violates our advertising/promotion rule, from noscripts and software to tutorials and videos.
We have received a number of requests for exemptions to the rule, and rather than allowing the front page to get consumed, we thought we'd try a weekly thread that allows for that kind of content. We don't have a catchy name for it yet, so please let us know if you have any ideas!
In this thread, feel free to show us your pet project, YouTube videos, blog posts, or whatever else you may have and share it with the community. Commercial advertisements, affiliate links, or links that appear to be monetization-grabs will still be removed.
https://redd.it/1pw0t2j
@r_systemadmin
There is a great deal of user-generated content out there, from noscripts and software to tutorials and videos, but we've generally tried to keep that off of the front page due to the volume and as a result of community feedback. There's also a great deal of content out there that violates our advertising/promotion rule, from noscripts and software to tutorials and videos.
We have received a number of requests for exemptions to the rule, and rather than allowing the front page to get consumed, we thought we'd try a weekly thread that allows for that kind of content. We don't have a catchy name for it yet, so please let us know if you have any ideas!
In this thread, feel free to show us your pet project, YouTube videos, blog posts, or whatever else you may have and share it with the community. Commercial advertisements, affiliate links, or links that appear to be monetization-grabs will still be removed.
https://redd.it/1pw0t2j
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
What projects can I do outside my work as sysadmin?
Lately, work has started to take over my life. There’s always the next project, and in helping the company, I’ve forgotten to invest in myself.
I love sysadmin and tech, and I want to spend my time learning or building projects that could automate my home, save me money, or even earn extra income. The projects I’ve been doing at home are related to work, so I worry that if I change jobs, I’ll lose that .
I’ve thought about fine-tuning AI, hosting a local AI agent, or creating home services to cut costs, but there are so many possibilities that I’m not sure where to start.
With my sysadmin and generalist background, what projects could I start that improve my skills, have income potential, and are realistic to tackle without a huge learning curve?
I have tried coding and that takes long time with fetures and features. My philosopy is small projects that makes me effective in my own economy. I have an idea on projects but no idea where to start
https://redd.it/1pw25hb
@r_systemadmin
Lately, work has started to take over my life. There’s always the next project, and in helping the company, I’ve forgotten to invest in myself.
I love sysadmin and tech, and I want to spend my time learning or building projects that could automate my home, save me money, or even earn extra income. The projects I’ve been doing at home are related to work, so I worry that if I change jobs, I’ll lose that .
I’ve thought about fine-tuning AI, hosting a local AI agent, or creating home services to cut costs, but there are so many possibilities that I’m not sure where to start.
With my sysadmin and generalist background, what projects could I start that improve my skills, have income potential, and are realistic to tackle without a huge learning curve?
I have tried coding and that takes long time with fetures and features. My philosopy is small projects that makes me effective in my own economy. I have an idea on projects but no idea where to start
https://redd.it/1pw25hb
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Too Many Duo Prompts? How Do Teams Meet 2FA Compliance
I started at a company that uses Duo and it feels pretty intense: I approve a Duo push to SSH in, then another when I switch users, and another when I
Is this typical for companies achieving some compliance like CMMC, or is it configured extra-strict? What are other teams doing to meet 2FA requirements for SSH/admin access without so many prompts? I like Yubikey, but seems this IT department ignored me outright when I inquired about it. Tapping the phone bites IMO!
https://redd.it/1pw2vnu
@r_systemadmin
I started at a company that uses Duo and it feels pretty intense: I approve a Duo push to SSH in, then another when I switch users, and another when I
sudo. Basically every hop prompts a phone tap. If I'm signing into my computer, its a Duo tap. Any RDP session is a Duo tap. It probably takes me 15 minutes to get all of my terminals rolling in the morning.Is this typical for companies achieving some compliance like CMMC, or is it configured extra-strict? What are other teams doing to meet 2FA requirements for SSH/admin access without so many prompts? I like Yubikey, but seems this IT department ignored me outright when I inquired about it. Tapping the phone bites IMO!
https://redd.it/1pw2vnu
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Has anyone been able to get Smartcard Login to work on Windows?
Really struggling with even knowing where to start looking on this one.
I'm a Junior SysAdmin and unfortunately the Senior ones haven't been too helpful on this.
I know E5 and E3s are going to include a PKI at some point and that is somehow relevant but I'm still struggling to understand exactly how that links in. For context, we are a hybrid environment.
I'm not even sure how to link a user's SmartCard to their AD profile or see what certs already exist on the profile!
If it helps at all, only about 400 devices out of 5000 need SmartCard based Logon. Most of the staff that will be logging on will have an E5. The devices in question will always be connected to our domain.
Is anyone able to give me a bit of a high level overview?
https://redd.it/1pw4kov
@r_systemadmin
Really struggling with even knowing where to start looking on this one.
I'm a Junior SysAdmin and unfortunately the Senior ones haven't been too helpful on this.
I know E5 and E3s are going to include a PKI at some point and that is somehow relevant but I'm still struggling to understand exactly how that links in. For context, we are a hybrid environment.
I'm not even sure how to link a user's SmartCard to their AD profile or see what certs already exist on the profile!
If it helps at all, only about 400 devices out of 5000 need SmartCard based Logon. Most of the staff that will be logging on will have an E5. The devices in question will always be connected to our domain.
Is anyone able to give me a bit of a high level overview?
https://redd.it/1pw4kov
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
Best 2025-2026 Document Scanners? - Looking for Suggestions
Hi everyone!
For anonymous purposes you can just refer to me as Cyb or Cyberius.
I currently work as an IT professional in a small-medium (\~200 employee) healthcare company, and we are a bit behind the times when it comes to hardware. One thing that we REALLY need to get up to date on is document scanners (Ricoh, Brother, etc.) as we still have ones dating back to \~2011.
The scanners that are being used currently are old KV-S1025 Panasonic Scanners that just aren't cutting it in terms of speed and other miscellaneous issues that we just can't seem to stay ahead on as the drivers and hardware are very dated. One scanner that does work pretty well is a Fujitsu Scanner Series 7xxx, but I believe this one is dated too so we want to try to find a better standard, if possible.
I have been doing some research online and in other subreddits, including this one, and was wondering what Document Scanners folks use at their workplace? Currently, I am leaning towards the Brother ADS Series but am fully open to suggestions.
Some other information that may help is the department that is in need of these scanners scan 100s of pages a day so something that is reliable and fast would be ideal to make sure their process is as smooth and efficient as possible.
Thank you!
https://redd.it/1pw7ulx
@r_systemadmin
Hi everyone!
For anonymous purposes you can just refer to me as Cyb or Cyberius.
I currently work as an IT professional in a small-medium (\~200 employee) healthcare company, and we are a bit behind the times when it comes to hardware. One thing that we REALLY need to get up to date on is document scanners (Ricoh, Brother, etc.) as we still have ones dating back to \~2011.
The scanners that are being used currently are old KV-S1025 Panasonic Scanners that just aren't cutting it in terms of speed and other miscellaneous issues that we just can't seem to stay ahead on as the drivers and hardware are very dated. One scanner that does work pretty well is a Fujitsu Scanner Series 7xxx, but I believe this one is dated too so we want to try to find a better standard, if possible.
I have been doing some research online and in other subreddits, including this one, and was wondering what Document Scanners folks use at their workplace? Currently, I am leaning towards the Brother ADS Series but am fully open to suggestions.
Some other information that may help is the department that is in need of these scanners scan 100s of pages a day so something that is reliable and fast would be ideal to make sure their process is as smooth and efficient as possible.
Thank you!
https://redd.it/1pw7ulx
@r_systemadmin
Reddit
From the sysadmin community on Reddit
Explore this post and more from the sysadmin community
MongoDB unauth exploit released, patch immediately
From: https://cyberplace.social/@GossiTheDog/115786817774728155
> Merry Christmas to everybody, except that dude who works for Elastic, who decided to drop an unauthenticated exploit for MongoDB (basically MySQL) on Christmas Day, that leaks memory and automates harvesting secrets (e.g. database passwords)
> CVE-2025-14847 aka MongoBleed
> Exp: https://github.com/joe-desimone/mongobleed/blob/main/mongobleed.py
> This one is incredibly widely internet facing and will very likely see mass exploitation and impactful incidents
> Impacts every MongoDB version going back a decade.
> Shodan dork: product:"MongoDB"
> The exploit is real and works, you can just run it and target specific offsets and/or keep running it until you get AWS secrets and such.
https://nvd.nist.gov/vuln/detail/CVE-2025-14847
> This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
https://redd.it/1pw913t
@r_systemadmin
From: https://cyberplace.social/@GossiTheDog/115786817774728155
> Merry Christmas to everybody, except that dude who works for Elastic, who decided to drop an unauthenticated exploit for MongoDB (basically MySQL) on Christmas Day, that leaks memory and automates harvesting secrets (e.g. database passwords)
> CVE-2025-14847 aka MongoBleed
> Exp: https://github.com/joe-desimone/mongobleed/blob/main/mongobleed.py
> This one is incredibly widely internet facing and will very likely see mass exploitation and impactful incidents
> Impacts every MongoDB version going back a decade.
> Shodan dork: product:"MongoDB"
> The exploit is real and works, you can just run it and target specific offsets and/or keep running it until you get AWS secrets and such.
https://nvd.nist.gov/vuln/detail/CVE-2025-14847
> This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
https://redd.it/1pw913t
@r_systemadmin
Cyberplace
Kevin Beaumont (@GossiTheDog@cyberplace.social)
Attached: 1 image
Merry Christmas to everybody, except that dude who works for Elastic, who decided to drop an unauthenticated exploit for MongoDB on Christmas Day, that leaks memory and automates harvesting secrets (e.g. database passwords)
CVE-2025-14847…
Merry Christmas to everybody, except that dude who works for Elastic, who decided to drop an unauthenticated exploit for MongoDB on Christmas Day, that leaks memory and automates harvesting secrets (e.g. database passwords)
CVE-2025-14847…