Tech Glossary — Page 8

Nextcloud is an open-source, self-hosted file sync and collaboration platform written in PHP. Organizations run it on their own servers for file sharing, calendars, contacts and document editing, extended through installable apps.

A VPN provider's commitment to not record or store user activity, connection times, or IP addresses.

Node-RED is an open-source, browser-edited flow programming tool built on Node.js that wires devices, APIs and services together. Its editor is not secured by default, and deployed flows can run system commands.

A Node-RED flow is a set of connected nodes saved as configuration and deployed to the Node-RED runtime. Because flows persist across reboots, a malicious flow acts as a durable backdoor.

A legitimate open-source utility that wraps any program so it can run as a Windows service. Attackers rename and reuse it to install malware, such as a cryptominer, as a persistent service that survives reboots.

An attack that embeds a NULL byte or character in input so the layer validating a string and the layer consuming it disagree about where it ends. It is commonly used to defeat filename extension checks, letting a disallowed file type pass a guard that only inspected the truncated name (CWE-158).

An open standard authorization protocol that allows applications to access user resources without exposing passwords, using tokens instead of credentials.

The OAuth 2.0 component that authenticates users, obtains their consent and issues access, refresh and ID tokens to client applications. It holds token signing keys, client secrets and the token store, so its compromise lets an attacker mint tokens that every resource server trusts without any login taking place.

A mechanism in OAuth that limits an application's access to a user's account, defining specific permissions like read email, send messages, or access files.

Over-The-Air update—firmware or software updates delivered wirelessly without physical connection.

Onigmo is the regular expression engine built into Ruby, written in C. It parses, compiles and matches every Ruby regexp, so bugs in it affect any Ruby application that compiles patterns.

A configuration in which any visitor can create an account on a self-hosted service without admin approval. It converts authenticated-only vulnerabilities into effectively unauthenticated ones, because the attacker can create the account the exploit requires.

Software with publicly available source code that anyone can inspect, modify, and distribute.

An identity layer built on OAuth 2.0. In CI/CD it lets a workflow present a short-lived, verifiable token and exchange it for temporary cloud credentials, removing the need to store long-lived secrets.

An open-source VPN protocol widely considered secure and reliable, though slower than WireGuard.

Hardware and software that monitors or controls physical equipment and processes, such as refrigeration, HVAC, manufacturing lines and utility systems. Unlike IT, a compromise of OT can cause physical damage, so availability and integrity of the process outrank data confidentiality.

An origin validation error is a flaw where software accepts a message or request without checking that it came from a trusted source, letting an attacker spoof a trusted sender and bypass authentication.

An emergency security patch released outside the normal update schedule to address critical vulnerabilities that can't wait for the next Patch Tuesday.

A memory-safety bug (CWE-787) in which a program writes data past the beginning or end of the buffer it allocated, corrupting adjacent memory. In file parsers it is typically triggered by a length or offset in attacker-controlled input and can be turned into arbitrary code execution.

PAPI is the Aruba control protocol that access points, controllers and Mobility Conductors use to exchange configuration and control data. It runs on UDP port 8211, with Instant AP clusters also using UDP 8209.

A legacy PHP package system whose command helper ships on many PHP hosts. When request-argument parsing is enabled, that helper reads commands from the query string, making it a favored inclusion gadget for turning a local file inclusion into remote code execution.

PHP-FPM is a service that runs PHP in separate pools of worker processes, which the web server reaches over FastCGI. Each pool can use its own user, settings and limits.

A security extension to OAuth 2.0 that prevents authorization code interception attacks by using a cryptographic code verifier and challenge.

Packet capture is the recording of network packets as they cross an interface, usually with tools such as tcpdump or Wireshark and saved as PCAP files. Attackers on a compromised host use it to collect plaintext credentials.

The page cache is the area of RAM where the Linux kernel keeps recently read file contents, so later reads and writes of that file are served from memory instead of disk. Every process on the host sees the same cached copy.

A database query in which the SQL statement is sent separately from the values it operates on, so user input can never be interpreted as SQL syntax. It is the standard defense against SQL injection, in contrast to building queries by string concatenation.

A security weakness that arises when two components in a request path interpret the same input differently, such as a firewall matching a raw path while the application server decodes it first. Attackers exploit the gap between the two readings to route a blocked request to a vulnerable endpoint.

An attack technique where an attacker uses a captured password hash to authenticate without needing to crack or know the actual password.

Software that securely stores and auto-fills passwords, generating strong unique passwords for each account.

A password salt is a random value combined with a password before hashing, so identical passwords produce different hashes. It is stored with the hash, as in the abc part of a $6$abc$ value.

A brute-force variant that tries one or a few common passwords against many accounts, rather than many passwords against one, to stay under per-account lockout thresholds.

A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program.

The second Tuesday of each month, when Microsoft releases its scheduled batch of security updates. The predictable cadence lets defenders plan deployment, but AI-assisted vulnerability discovery has pushed recent releases past 900 CVEs, straining triage.

The process of converting a request path to a single canonical form by decoding encoded characters, folding case where applicable, and collapsing redundant separators and traversal sequences. Making security decisions on the normalized path, rather than the raw input, closes the gap that encoding-based evasions exploit.

A web vulnerability (CWE-22) where user-supplied input in a file path escapes the directory the application intended to serve from, typically via parent-directory references, letting an attacker read or write files elsewhere on the server.

An open-source high-availability manager for PostgreSQL that handles leader election, failover, replica creation and dynamic configuration, driven through a REST API. The API's state-changing endpoints are unauthenticated unless basic auth, client certificates or an allowlist are configured.

A string credential that authenticates to GitHub's API and git operations on behalf of a user account, often with broad and long-lived permissions. A stolen PAT gives an attacker the same access as the user.

A social engineering attack using fake emails or websites to steal login credentials or personal info.

A physical access control system is the set of cards, readers, door controllers and central software that decides who can open which door and when, and logs each entry attempt.

Pluggable Authentication Modules is the Linux and Unix framework that lets programs such as su, sudo and sshd hand authentication decisions to configurable modules, defined in files under /etc/pam.d.