Tech Glossary — Page 13

adminAuth is the Node-RED settings option that requires a login for the editor and admin API, using local accounts with bcrypt password hashes or an OAuth or OpenID provider.

crypt() is the C library function that turns a password and salt into the hash string stored for an account. Login programs compare its output to the stored field, so its error behavior affects security.

doas is a command that lets a permitted user run commands as another user, usually root. It is a small alternative to sudo, and a passwordless doas rule means a compromised account can become root.

execInstalledOnly is an ESXi setting that only lets the host run binaries installed through VIB packages, which blocks dropped implants and scripts from executing.

A script attached to an F5 BIG-IP virtual server that inspects and acts on traffic in the data plane. Vendors and operators use iRules as virtual patches to block exploit traffic before it reaches vulnerable code, as F5 did for CVE-2026-94127, but they are a stopgap until the software fix is installed.

A Linux file read by the dynamic linker that lists shared libraries to load into every dynamically linked process before any other library. Designed for legitimate interposition, it is a favored persistence mechanism: writing a path into it forces attacker code to load into processes system-wide, including root-owned ones.

mod_php is an Apache module that loads the PHP interpreter into every Apache worker process, so PHP code runs inside the web server under the same account. It is simple to set up but offers no per-site isolation.

musl libc is a lightweight C standard library for Linux, used by Alpine and many embedded builds. It behaves differently from glibc in some edge cases, which can change how programs handle errors.

occ is Nextcloud's command-line administration tool. Administrators run it as the web server user to upgrade the instance, list and manage apps, and verify core and app files against Nextcloud's signed file lists with the integrity check commands.

A PHP configuration directive that confines all filesystem access, including include and require, to a named directory tree. Set to the application's own paths, it blocks a file-inclusion bug from reaching gadgets or writable directories elsewhere on the server, breaking the escalation to code execution.

pip-audit is an open source tool that scans Python environments and requirements files for packages with known vulnerabilities, using advisory databases such as PyPI and OSV.

A PHP configuration directive, enabled by default, that populates the argument variables from request data. Web applications rarely need it, but leaving it on lets gadgets such as PEAR's command helper read attacker-controlled arguments from the query string, a key link in local-file-inclusion attack chains.

sitecustomize is a Python module that the interpreter imports automatically at startup if it exists on the module search path. Administrators use it for site-wide setup; malicious packages use it to run code on every Python start.

vpxuser is the privileged account vCenter creates on each managed ESXi host to run management tasks. Attackers who control vCenter can abuse it to move between hosts.

A vulnerability that can be exploited to spread automatically from system to system without user interaction, similar to how biological worms spread.

Cryptocurrency tokens pegged 1:1 to another asset (like WETH for Ethereum) that enable the underlying asset to be used on different blockchains or in DeFi protocols.

The wp_options table is the WordPress database table that stores site settings and plugin configuration as named rows. Malware often hides payloads or persistence data there because few administrators inspect it.

The standard format for public-key certificates used by TLS, IPsec, and code signing. It binds a public key to an identity, is signed by a certificate authority, and is encoded in ASN.1, which is why parsing it safely is a recurring security problem.

XFRM is the Linux kernel framework that transforms network packets for IPsec, handling security policies, security associations and the encryption and decryption of ESP and AH traffic, including ESP carried inside TCP.

An attack technique against XML-based protocols like SAML where attackers move a signed portion of a document while inserting malicious unsigned content, exploiting differences between signature verification and document processing.

An open-source, high-performance miner for the Monero cryptocurrency. It is widely abused by attackers who deploy it on compromised servers to mine coins using stolen compute, often disguised as a legitimate process.

A wireless protocol for smart home devices, known for reliability and less interference than WiFi.

A security model that requires strict verification for every user and device trying to access resources, regardless of whether they're inside or outside the network perimeter.

An exploit that compromises a device without any action by the user, usually by abusing a component that automatically parses inbound data such as message attachments, link previews or image thumbnails. Zero-click chains are expensive and are mostly used against specific high-value individuals.

A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patch, giving developers 'zero days' to fix it.

A security model where the service provider has no ability to access your decrypted data.

A low-power wireless protocol commonly used for smart home device communication.

Zone.Identifier is the NTFS alternate data stream where Windows stores a file's Mark of the Web. Its ZoneId value records the source zone, with 3 meaning Internet and 4 meaning Restricted sites.