Critical Saltstack Vulnerability Patching

Censys reports on the disclosure of two critical SaltStack vulnerabilities (CVE-2020-11651 and CVE-2020-11652) that enable full takeover of systems Salt manages; their Internet-wide scans found 5,841 likely-exposed Salt servers on May 1 and 3,722 on May 6 (a 36% reduction), showing some rapid patching but a substantial remaining attack surface.