Tech Glossary

A .pth file is a path configuration file in a Python site-packages directory that the interpreter reads at startup. Lines add directories to the module search path, and lines starting with import are executed, which attackers abuse for persistence.

An IEEE standard for port-based network access control. A device connecting to a switch port or wireless network must authenticate, usually via a RADIUS server, before the port forwards its traffic; the server's response can also assign a VLAN or access policy.

A symmetric encryption algorithm widely used for securing sensitive data; AES-256 is military-grade.

A Windows interface that allows applications and services to integrate with anti-malware products, enabling security software to scan scripts and memory content before execution.

A set of rules and protocols that allows different software applications to communicate with each other, enabling data exchange and functionality sharing between systems.

A reverse proxy that sits in front of backend services, authenticating clients, enforcing rate limits and policy, and routing requests. Because it registers every client and stores every backend definition, an administrator on the gateway can reach credentials for everything it fronts.

A sophisticated, long-term cyberattack campaign, typically by nation-state actors, that gains unauthorized access and remains undetected to steal data or conduct espionage.

A network protocol that maps IP addresses to MAC (hardware) addresses, enabling devices to communicate on local networks.

Abstract Syntax Notation One, a standard for describing structured data as tag-length-value elements. X.509 certificates are ASN.1 encoded, so every TLS and IPsec endpoint contains an ASN.1 decoder that runs on untrusted input, a frequent source of memory-safety bugs.

A credential issued by an authorization server that grants an application temporary access to specific resources on behalf of a user.

An attack where adversaries gain unauthorized access to a user's online account, typically through credential theft, social engineering, or token abuse.

A vulnerability that attackers are currently using in real-world attacks, requiring immediate patching regardless of severity score.

A defense that places code and data at unpredictable memory addresses each time a program runs, so an attacker cannot hardcode where to jump. Exploits defeat it with an information leak that reveals a real address at runtime.

The internal Windows mechanism that lets processes on the same machine exchange messages, used heavily by system services and sandboxed components. Memory-corruption bugs in ALPC, like CVE-2026-85880, can let sandboxed code escape and elevate to SYSTEM.

An intrusion carried out by autonomous AI software that selects its own next actions without human direction, chaining exploitation, privilege escalation, lateral movement and exfiltration at machine speed.

A JWT attack in which the verifier lets the token's header decide which algorithm to verify with, or fails to reject an algorithm it does not support, so an attacker-signed token passes the signature check. It is the class of bug behind the WSO2 API Manager bypass CVE-2026-5430.

Techniques attackers use to hide or destroy evidence of intrusion, such as deleting or truncating log files, clearing event logs, or altering timestamps. Missing logs are themselves an indicator of compromise.

A Microsoft Defender for Cloud Apps feature that provides visibility into OAuth apps, detects anomalous behavior, and enables policy-based controls over third-party application access.

A Windows sandbox that runs code with a restricted token and limited access to files, network and other resources, used by browser renderers and Office protected view. Attackers chain a local privilege-escalation bug to break out of an AppContainer and reach SYSTEM.

AppImage is a Linux packaging format that bundles an application and its dependencies into a single executable file, so it runs without installation through the system package manager. It is not updated by the distribution's security patches.

A network appliance, such as F5 BIG-IP, that sits in front of applications to load-balance, terminate TLS, apply access policies and often act as an authentication or OAuth gateway. Because it holds keys and sessions for everything behind it and is exposed to the internet by design, it is a high-value target for pre-authentication exploits.

An exploitation outcome where an attacker can retrieve any file the vulnerable application's process can open. On platforms that store configuration and encryption keys on disk, an arbitrary file read is often equivalent to full credential theft.

A vulnerability class in which an attacker controls both the contents and the destination path of a file written by a target system. On a general-purpose OS it is usually equivalent to code execution, because files written to certain locations are loaded or run automatically.

A flaw (CWE-88) in which attacker-controlled input is passed into a command or program as arguments without neutralizing delimiters, so a value such as a username beginning with a dash is interpreted as an option rather than data. In RouterOS this allowed privilege escalation via a crafted SSH username (CVE-2026-86060).

A server that stores and serves the binary outputs of software builds (packages, container images, libraries) plus the dependencies pulled into them. Because every deployment consumes its contents, administrative compromise of an artifact repository lets an attacker tamper with the software supply chain at scale.

The endpoint on a SAML service provider that receives the signed SAML response from the identity provider and establishes the user's session. It accepts HTTP POSTs from any client by design, which makes its XML parsing pre-authentication attack surface.

A security posture that plans as though attackers are already inside the environment, prioritising segmentation, least privilege, detection and rapid containment over perimeter defence alone.

Attack Complexity is the CVSS base metric that describes conditions beyond the attacker's control that must exist to exploit a flaw. It is rated High when, for example, repeated attempts are needed to win a race condition.

The sum of all points where an unauthorized user could attempt to enter or extract data from a system: exposed services, interfaces, accounts, and integrations. Reducing attack surface means removing reachability, not just patching.

The continuous practice of discovering, inventorying, classifying and reducing every point where an attacker could reach a system, including optional modules, unauthenticated endpoints and forgotten exposures. ASM answers the question 'are we affected?' when an advisory arrives.

A set of configurable Microsoft Defender rules that block common malware behaviors, such as script interpreters launching downloaded executables or the execution of obfuscated scripts, adding behavioral guardrails independent of file signatures.

The CVSS base metric describing how far an attacker must be from the vulnerable component: Network, Adjacent, Local or Physical. It reflects the vendor's intended deployment, so an Adjacent-rated bug on an internet-exposed interface is effectively Network in practice.

A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials.

Authentication fallback is a secondary login method kept available alongside a primary one such as SSO. If it does not enforce the same policy, it can give attackers a route around MFA.

An encrypted cookie a VPN portal or gateway issues after a successful login so the client can reconnect without re-entering credentials. It acts as a bearer token, so its confidentiality and integrity protection decide whether it can be stolen or forged.

The most secure OAuth 2.0 flow where the client receives an authorization code that is exchanged for tokens via a back-channel server request.

A Microsoft service that automatically configures email client settings by querying DNS records to locate the Exchange server.

Microsoft's command-line interface for managing Azure resources and services, commonly used by developers and IT administrators for automation and deployment tasks.

CISA Binding Operational Directive 22-01, which requires U.S. Federal Civilian Executive Branch agencies to remediate vulnerabilities listed in the Known Exploited Vulnerabilities catalog by a set deadline. CISA shortens the deadline when exploitation is widespread.

CISA Binding Operational Directive 26-04, issued 10 June 2026, which replaced BOD 22-01. It assigns federal civilian agencies remediation deadlines of 3, 14, or 60 days based on asset exposure, KEV status, exploit automation, and post-exploitation impact, and requires forensic triage for the 3-day tier.