Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.…
Debian LTS PHP 8.2 Fixes Critical Request Handling Flaws
Two critical vulnerabilities were found in PHP, a widely-used open source general purpose scripting language, which could result in remote execution of arbitra…
Fedora 43 webkitgtk Important Security Update CVE-2026-84635 CVE-2026-64753
Update to 2.54.1: Allow pasting in-memory image data from clipboard. Add User-Agent quirk for Amazon Luna. Align the filter surface with the device pixel grid.…
Debian 12 gst-plugins-bad1.0 Important DoS Memory Leak Attacks DLA-4839-1
Several vulnerabilities were discovered in gst-plugins-bad1.0, a collection of plugins for the GStreamer multimedia framework. Processing specially crafted med…
NGINX Vulnerability Fixes Require More Than a Version Check
NGINX has patched flaws that could let request data bypass a size limit or allow an encrypted session to be forged.
Curl Vulnerability Can Let a Malicious Server Run Code During Uploads
A curl vulnerability can let a malicious upload server run commands on the computer sending it data.
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows develo…
Debian mariadb Critical Unauthorized Access Denial of Service DLA-4835-1
Multiple vulnerabilities were discovered in MariaDB, a SQL database server compatible with MySQL. An authenticated attacker may perform denial-of-service, unau…
Fedora 43 Aegisub CVE-2026-92705 Fixes Arbitrary Code Execution Advisory
Update to Aegisub 3.5.0, fixing CVE-2026-92705: arbitrary code execution when opening crafted ASS subtitle files containing associated Automation script refere…
Fedora 44 Aegisub 3.5.0 CVE-2026-92705 Arbitrary Code Exec Fix
Update to Aegisub 3.5.0, fixing CVE-2026-92705: arbitrary code execution when opening crafted ASS subtitle files containing associated Automation script refere…
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed…
Docker Hub flaw let attackers impersonate users, tamper with images
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal …
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator …
Debian Stable Vips DSA-6552-1 Addresses Multiple Security Vulnerabilities
Several vulnerabilities have been discovered in vips, a fast image processing library. These vulnerabilities could result in denial of service, memory safety i…
Cisco warns of critical flaws allowing Nexus switch takeover
Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary…
Atlassian warns of critical file-access flaw in Jira, Confluence
Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted …
Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers
In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol d…
Fedora 43 cockpit-machines Local Attack Disclosure CVE-2026-92768 Details
Automatic update for cockpit-machines-357-1.fc43. Changelog for cockpit-machines * Wed Sep 23 2026 Packit - 357-1 - Harden against local attacks from accessing…
Debian Redis High Severity Denial of Service Code Execution DSA-6538-1
Multiple vulnerabilities were discovered in Redis, a persistent key-value database, which could result in denial of service or the execution of arbitrary code.…
Debian libio-compress-perl Critical CPU Exhaustion and Code Exec DLA-4812-1
Multiple vulnerabilities were discovered in libio-compress-perl, a Perl library to allow reading and writing of compressed data. CVE-2025-15649 Uncaught except…
Debian WebKitGTK Important Heap Corruption Privilege Escalation DSA-6534-1
Several vulnerabilities have been discovered in the WebKitGTK web engine, that may lead to heap corruption, local privilege escalation, remote code execution, …
Debian LTS DLA-4808-1 network-manager-l2tp Critical Privilege Escalation
Andres Berbescu discovered two vulnerabilities in the L2TP connection plugin for Network Manager which allowed a local user with permissions to create/activate…
Debian LTS DLA-4802-1 Python-Django Critical Cache Exposure
Multiple vulnerabilities were discovered in Django, the Python-based web development framework: CVE-2026-48587 Potential exposure of private data via whitespac…
Fedora 43 perl-Imager Key Concerns with TGA Color Map and Palette
1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uni…