SSD Secure Disclosure

https://ssd-disclosure.com/

Added 2026-07-28 as this run's single new candidate. Coordinated-disclosure programme publishing original root-cause analyses and working proof-of-concept code for vulnerabilities it brokers (primary source for CVE-2026-61511, the vBulletin runMaths pre-auth RCE). Rated B: original vulnerability research, not a first-party vendor authority. FETCH: direct WebFetch returns a partial render; `python3 tools/fetch_source.py url <article-url>` succeeded this run via the reader fallback and returned the full advisory including the root-cause section. | 2026-08-08: rotation-priority catch-up succeeded via the jina reader; the landing page enumerated dated advisories and one article body was retrieved. A second article returned HTTP 202 direct and a robot-challenge page through the reader, so per-article retrieval remains partial. Listing extraction is no longer the blocker; per-article anti-bot is. | 2026-08-09: regression, the landing page itself now returns a Cloudflare-style robot-challenge interstitial through both the direct bridge and the reader, where on 2026-08-08 the reader enumerated the dated advisory listing successfully. Independently observed by S1 and S3. 403/anti-bot never demotes; needs a new transport, not a status change. | 2026-08-10: RECIPE FIX: per-article advisory pages fetch cleanly via `fetch_source.py url <URL>` (direct); it is the jina-reader path that returns a Cloudflare-style robot-challenge interstitial on this host. Try direct FIRST for article bodies and reserve the reader for the listing page. Recovered the Linux bridge STP UAF advisory this run after two prior runs logged it as a transport failure. | 2026-08-11: the listing page https://ssd-disclosure.com/ returned a Cloudflare-style robot-challenge (HTTP 202) to BOTH the direct transport and the reader this run, which inverts the 2026-08-10 recipe note in the other direction: direct works for a KNOWN per-article URL, but neither transport reaches the listing, so discovery has no entry point without an article URL in hand. Keep the direct transport for article bodies; for discovery, try a feed/sitemap path next run before treating the source as unreachable. | 2026-08-13: HTTP 202 Cloudflare robot challenge on both direct fetch and the jina reader again this run; no in-window content recoverable. Transport block, not death, no demotion. | 2026-08-18: fetch_method jina -> bridge. Pinning this host to the reader is indefensible on two counts: the pool is credit-exhausted, and this record's own 2026-08-10 note documents the reader as the transport that gets the robot-challenge interstitial here while the direct `url` transport reads article bodies. Observed this run: the two Unisoc advisory pages returned HTTP 202 with a 187-byte shell to the direct transport, so neither rung reached content today and the surfaced finding could not be published on the primary. Needs a feed/sitemap probe. | 2026-08-18: UNSOLVED flag worked this run: five direct paths probed with a desktop browser user agent (two advisory article pages, /feed/, /rss, /sitemap.xml and the WordPress REST posts endpoint) and every one returned HTTP 202, the anti-bot challenge interstitial rather than content. No direct rung reaches this host today. NOT demoted (an anti-bot challenge is transport blocking) and NOT muted to fetch_method blocked, because the host served article bodies to the direct transport on 2026-08-10 and the reader has not been tested this run for want of credit; the block is intermittent, so muting it would silence a research primary that works on other days. | 2026-08-19: advisory pages still unreadable: alternate transports attempted this run were the archive host (refused/connection-reset) and a feed/sitemap probe, both failing inside the 5-minute budget. The Unisoc backlog row stays open. | 2026-08-19 RECIPE CORRECTION (evidence-based, reverses the 2026-08-18 change): the block on this host is NOT a client-rendered SPA and is NOT intermittent; it is a site-wide SiteGround anti-bot interstitial. Every path probed this run (/feed/, /rss, /advisories/feed/, /sitemap.xml, /wp-sitemap.xml and both Unisoc advisory pages) returned HTTP 202 with a 170-190 byte body whose only content is a meta-refresh to /.well-known/sgcaptcha/?r=<the requested path>. No feed, sitemap or article path escapes it, so there is no direct transport to author a recipe against. The reader proxy runs page JS server-side from its own egress and is therefore the correct transport for this host; fetch_method is set back to jina on that basis. The 2026-08-18 note reasoned the reader receives the challenge; today's evidence is that the DIRECT transport receives it, which is the opposite. Deliberately NOT set to blocked: blocked means unreachable by every transport including the reader, and the reader has not failed on its merits here, only on credit. | 2026-09-03: anti-bot interstitial again on both direct bridge and jina fallback (listing page). This run's own source_health.py sweep separately classed it bridge-ok, so the block is content-shape-specific (listing page) rather than whole-host; no working per-article URL was in hand to test directly. Not demoted (403/429-class block, not a dead recipe). | 2026-09-04: 6th consecutive anti-bot interstitial on both direct bridge and jina fallback; no per-article URL in hand to test around it. Not demoted. | 2026-09-05 audit: 7th consecutive run blocked by Cloudflare Robot Challenge Screen on both direct bridge and jina fallback. | 2026-09-06: 8th/9th consecutive run blocked by the Cloudflare Robot Challenge Screen on both the direct bridge and the jina reader fallback (S1, S3 independently); no per-article URL in hand to test around it. Not demoted (anti-bot class block, not source death). | 2026-09-07: set fetch_method=blocked per the genuinely-unreachable-by-every-transport rule. S1 and S3 both independently confirmed a Cloudflare Robot Challenge Screen on direct bridge AND the jina reader fallback this run (10+ consecutive blocked runs); S3 additionally checked the ssd-secure-disclosure GitHub advisories mirror as a bypass route and found its last commit dates to 2020 (does not track current advisories). Stop re-flagging as unsolved every run; re-probe only if the operator reports the block has lifted. | 2026-09-10 audit note (S1/S3 rotation-priority retry): the 'blocked' flag no longer reflects reality, both the homepage (via S1) and the advisories listing plus individual advisory pages (via S3, both bridge url and extract) now resolve cleanly through the jina reader fallback. fetch_method corrected from blocked to jina; rotation_priority should clear on a second consecutive confirming run. No in-window item found this run (the two most recent posts predate the 24h window).