Medium

Jonathan Leitschuh

he/him

Pinned

In

InfoSec Write-ups

by

Jonathan Leitschuh

·

Jul 2, 2025

Burn It With Fire: How to Eliminate an Industry-Wide Supply Chain Vulnerability

The supply chain bug that couldn’t be ignored — so I torched it.

Burn It With Fire: How to Eliminate an Industry-Wide Supply Chain Vulnerability

Pinned

In

InfoSec Write-ups

by

Jonathan Leitschuh

·

May 14, 2025

When Open Source Isn’t: How OpenRewrite Lost Its Way

Moderne quietly relicensed community-contributed OpenRewrite code from Apache 2.0 to a proprietary license.

When Open Source Isn’t: How OpenRewrite Lost Its Way

Pinned

In

InfoSec Write-ups

by

Jonathan Leitschuh

·

Jun 6, 2025

5 Years, 160 Comments, and the Vulnerability That Refused to Die

How a 5-year-old deserialization flaw, a vacation phone call, and some persistence led to a safer Java ecosystem

5 Years, 160 Comments, and the Vulnerability That Refused to Die

Pinned

In

InfoSec Write-ups

by

Jonathan Leitschuh

·

Jul 8, 2019

Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!

Vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission. The flaw potentially…

Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!

In

InfoSec Write-ups

by

Jonathan Leitschuh

·

Jan 8

Digital Travel App TripBFF Exposed Location Data Way Too Accurately

TripBFF exposed recent live latitude & longitude data and birth date for every user on their platform

Digital Travel App TripBFF Exposed Location Data Way Too Accurately

In

InfoSec Write-ups

by

Jonathan Leitschuh

·

Sep 15, 2025

The CVE CNA 72 Hour Rules are Insane

The bureaucracy of the CVE system continues to frustrate me. Next up: the publicly disclosed vulnerability 72 hour rule!

The CVE CNA 72 Hour Rules are Insane

In

InfoSec Write-ups

by

Jonathan Leitschuh

·

Jul 31, 2025

What’s an OSS Vulnerability Janitor?

What does it take to sweep up after the industries security vulnerabilities that have been left unpatched or undisclosed?

What’s an OSS Vulnerability Janitor?

Jonathan Leitschuh

·

Apr 14, 2025

Falsehoods People Believe about CVE’s

CVE ≠ Vulnerability (And 35 Other Confusions Regarding CVE)

Falsehoods People Believe about CVE’s

Jonathan Leitschuh

·

Jul 8, 2024

You may want to be careful with your choice of `wkhtmltopdf`.

https://wkhtmltopdf.org/status.html

In

InfoSec Write-ups

by

Jonathan Leitschuh

·

Jan 8, 2020

Update: Want to take over the Java ecosystem? All you need is a MITM!

January 13th-15th, 2020 will break over 21% of the industry’s Java build infrastructure. Six months since my initial article disclosing…

Update: Want to take over the Java ecosystem? All you need is a MITM!

Jonathan Leitschuh

Jonathan Leitschuhhe/him

Vulnerability Janitor, Security Researcher, Software Engineer, Public Speaker, Open Source Contributor

Following

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech