Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
In yet another software supply chain attack, threat actors have managed to compromise the popular Python package Lightning to push two malicious versions to co…
2026/03/24: fix missing fclose and potential double free in option file parsing 2026/03/23: upnphttp.c: fix removal of quotes in ParseHttpHeaders() minixml.c: …
Most information security best practices are built on a single, comfortable assumption: that if we find a bug, we can patch it, and once it's patched, the syst…
Think about Linux security like the structural integrity of a building. Most information security best practices focus on the front door''locks, cameras, and I…
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help …
CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode CVE-2026-35388: Add connection multiplexing confirmation for …
CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode CVE-2026-35388: Add connection multiplexing confirmation for …
Containers were sold on the promise of container isolation. Think of them like clean, separate rooms in a house where nothing leaks from one room to another. M…
Cybersecurity researchers have discovered a critical "by design" weakness in the Model Context Protocol's (MCP) architecture that could pave the way for remote…
The National Institute of Standards and Technology (NIST) has announced changes to the way it handles cybersecurity vulnerabilities and exposures (CVEs) listed…
LibRaw 0.22.1 and rebuilds Release 3.1.12.0 (Apr 1, 2026) -- compared to 3.1.11.0 oiiotool: Better type understanding with -i:ch= and other cleanup #5056 textu…
LibRaw 0.22.1 and rebuilds Release 3.1.12.0 (Apr 1, 2026) -- compared to 3.1.11.0 oiiotool: Better type understanding with -i:ch= and other cleanup #5056 textu…
OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user da…
1.6.56 is release fixes for the following two security vulnerabilities: CVE-2026-33416 (high severity): Use-after-free memory bug in the transparency and palet…
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new phishing campaign in which the cybersecurity agency itself was imperso…
Microsoft is calling attention to a new campaign that has leveraged WhatsApp messages to distribute malicious Visual Basic Script (VBS) files.The activity, beg…
A previously unknown vulnerability in OpenAI ChatGPT allowed sensitive conversation data to be exfiltrated without user knowledge or consent, according to new …
One unauthenticated HTTP request is all it takes. From there, attackers can move from the edge straight into your internal network, operating from a system you…
Update to v46.0.6 This includes a single fix for security issue: * **SECURITY ISSUE**: Fixed a bug where name constraints were not applied to peer names during…
Update to v46.0.6 This includes a single fix for security issue: * **SECURITY ISSUE**: Fixed a bug where name constraints were not applied to peer names during…
Threat actors with ties to Iran successfully broke into the personal email account of Kash Patel, the director of the U.S. Federal Bureau of Investigation (FBI…
Cybersecurity researchers have flagged a new evolution of the GlassWorm campaign that delivers a multi-stage framework capable of comprehensive data theft and …
What is a port scan?A port scan is a diagnostic or reconnaissance technique used to identify open communication ports on a remote system. By sending packets to…
Security teams today are not short on tools or data. They are overwhelmed by both. Yet within the terabytes of alerts, exposures, and misconfigurations – secur…
