Tech Glossary — Page 9

A polyglot file is a single file that is valid in more than one format, such as an image that a PHP interpreter or browser can also read as code. Attackers use them to slip past upload checks that only confirm the claimed file type.

Directing incoming traffic on specific ports to a particular device on your network.

A flaw that can be exploited without valid credentials or an active session, typically by sending crafted input to a network-exposed service. Pre-auth bugs in internet-facing systems are the most urgent class to patch because any remote attacker can reach them.

A predictable identifier is a token, file name, session ID or record number that should be hard to guess but can be calculated or guessed, for example because it is sequential, time based or made by a weak generator. MITRE tracks the weakness as CWE-340.

A social engineering technique where attackers create a fabricated scenario (pretext) to manipulate victims into providing information or taking actions they normally would not.

An attack technique where an adversary gains elevated access rights beyond what was initially granted.

A privileged access workstation is a locked-down device used only for administrative tasks, with no email or web browsing. It keeps admin credentials off everyday machines that are more likely to be compromised.

A Microsoft Entra ID feature enabling just-in-time privileged access, requiring approval and time limits for admin role activation to reduce standing privilege risks.

Privileges Required is the CVSS base metric that records what account level an attacker must already hold to exploit a vulnerability: None, Low or High. A High value lowers the score but says nothing about whether the flaw is exploited.

Process injection is a technique in which code is written into the memory of another running process and executed there, so it runs with that process's privileges and blends in with its normal activity.

The parent-child chain of processes on a host, showing which process launched which. Hunting on lineage catches exploitation because compromised services spawn children they never would in normal operation.

A defensive-evasion technique in which malware names its running process to imitate a legitimate system process, such as a kernel worker thread or a font or time-sync daemon, so it blends into normal process listings. The StyleSmuggler implant used kworker, fc-cache and chronyd disguises.

An attack that embeds instructions in content a language model will process, so the model takes actions the operator did not intend. In blind prompt injection the attacker cannot see the output and instead confirms execution through a side channel such as a DNS callback to a domain they control.

Code or a documented technique that demonstrates a vulnerability can be exploited in practice. Publishing a PoC sharply lowers the skill needed to attack a flaw, and mass scanning often follows within hours of its release.

Software owned by a company with restricted access to source code.

Protected View is the read-only, sandboxed mode Microsoft Office uses to open files from the internet and other untrusted sources. Editing and active content stay disabled until the user chooses to enable them.

Proxyware is software that relays other people's internet traffic through the host it runs on, so the traffic appears to come from that host's IP address. Attackers install it on compromised machines and sell access as a residential proxy service.

Pseudonymization is the replacement of direct identifiers with tokens while a separate mapping still allows reidentification. Under GDPR, pseudonymized data is still personal data.

Network feature that prioritizes certain traffic types (like video calls) over others.

A social engineering technique where attackers offer something (like IT support) in exchange for information or access, exploiting the human tendency to reciprocate.

Remote Authentication Dial-In User Service, the protocol network devices use to ask a central server whether a user or device should be granted access and with what attributes. Each device shares a secret with the server, so a compromised server exposes the secrets of every device that trusts it.

A critical vulnerability class that allows an attacker to run arbitrary code on a target system from a remote location, typically over a network or the internet, without requiring physical access.

A platform used by IT providers to monitor, patch, script and remotely control large fleets of endpoints from a central console via a privileged agent on each machine. Because the console can execute code on every managed device, its compromise gives an attacker fleet-wide access, as in the 2026 N-able N-central attacks.

A flaw where the outcome of code depends on the timing of concurrent operations that share state without proper synchronization. Attackers exploit kernel race conditions by winning the timing window to corrupt data structures or bypass checks.

A cybercrime business model where ransomware developers create malware and license it to affiliates who conduct attacks in exchange for a share of ransom payments.

A server-side control that caps how many requests a client may make in a given window, such as per minute or per day. Effective limits for sensitive lookups are derived from the client's stated business purpose, not from gateway defaults.

Wiping a device and reinstalling its operating system and firmware from clean vendor media rather than patching in place. Re-imaging is the standard recovery step for a compromised appliance because a patch closes the vulnerability but does not remove anything an attacker installed after exploiting it.

ReDoS (regular expression denial of service) is an attack where a pattern or input forces a backtracking regex engine into extreme amounts of work, tying up CPU and making a service unresponsive.

A long-lived credential used to obtain new access tokens without requiring the user to re-authenticate, enabling persistent application access.

A regular expression is a pattern language for matching text. An engine compiles each pattern into an internal program before running it, which is why user-supplied patterns are attack surface.

Malware that gives an attacker persistent, interactive control of a compromised host, typically including a shell, file transfer, and network tunneling. RATs on network appliances often harvest and decrypt the device's stored credentials.

An MDM capability that allows administrators to erase data from a lost or stolen mobile device remotely.

The sandboxed browser process that parses HTML, runs page JavaScript and paints content. It has no direct file, network or process-creation rights and reaches them only through IPC to the browser process, so code execution inside it is contained until an attacker also escapes the sandbox.

A locally hosted copy of a vendor's package or firmware repository that internal systems pull from instead of the internet. It confines vendor trust to one controlled host, enables egress blocking and makes update content a reviewable, versioned snapshot.

A residential proxy is a proxy service whose exit nodes sit on home or small business internet connections instead of data centers. Its traffic is harder to block, which is why abuse operators build these networks from hijacked devices.

A NetScaler feature that inspects incoming requests against a rule and takes an action such as dropping, resetting, or redirecting them before the request reaches the back-end service. Vendors sometimes supply a responder policy as an interim workaround for a vulnerability until a fixed build is installed.

An exploitation technique that chains together small fragments of a program's existing code, called gadgets, to perform arbitrary actions. It sidesteps protections that block injected shellcode by reusing code the program already contains.

A server that sits in front of one or more backend services, terminating client connections and forwarding requests to the backend. It is the standard place to add authentication, TLS and access control to a service that lacks its own, without modifying the application.

A reverse SSH tunnel is an SSH connection opened from inside a network to an outside server that forwards ports back inward, letting whoever controls the outside server reach internal systems through the connection.

A remote-access technique where a compromised host initiates an outbound connection back to the attacker and hands over a command shell. Because the connection originates inside the network, it often slips past firewalls that block inbound traffic.