Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump. (CVE-2025-4598) Referenc…
Security constraint bypass for CGI scripts. (CVE-2025-46701) References: - https://bugs.mageia.org/show_bug.cgi?id=34332 - https://openwall.com/lists/oss-secur…
cifs.upcall makes an upcall to the wrong namespace in containerized environments. (CVE-2025-2312) References: - https://bugs.mageia.org/show_bug.cgi?id=34315
IoT devices have always been a juicy target for attackers''they're often undersecured, overlooked, and ripe for exploitation. But here's where PumaBot, a Go-ba…
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is s…
This update contains the backported fix for CVE-2024-52804 (cookie parsing DoS vuln).
This contains the backported fix for CVE-2024-52804 (cookie parsing DoS vuln)
The threat actors behind the DragonForce ransomware gained access to an unnamed Managed Service Provider's (MSP) SimpleHelp remote monitoring and management (R…
A client-side desync vulnerability can be triggered in Varnish, a high-performance web accelerator. An attacker can abuse a flaw in Varnish¢''s handling of chu…
A client-side desync vulnerability can be triggered in Varnish, a high-performance web accelerator. An attacker can abuse a flaw in Varnish¢''s handling of chu…
Google on Wednesday disclosed that the Chinese state-sponsored threat actor known as APT41 leveraged a malware called TOUGHPROGRESS that uses Google Calendar f…
The update for net-tools announced in DSA 5923-1 introduced a regression for ifconfig always showing zero value packet counters. Updated packages are now avail…
Sender Spoofing via Malformed From Header in Thunderbird. (CVE-2025-3875) Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:…
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*n…
VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday revealed that Commvault is monitoring cyber threat activity targeting applications…
Imagine you're sitting down at your desk, coffee in hand, ready to tackle the day, and you're met with this: a new campaign, slyly dubbed ''ClickFix,'' is burr…
Modern apps move fast—faster than most security teams can keep up. As businesses rush to build in the cloud, security often lags behind. Teams scan code in iso…
Google on Wednesday released updates to address four security issues in its Chrome web browser, including one for which it said there exists an exploit in the …
In modern computing, the line dividing speed from security is razor-thin. Performance innovations have helped processors handle billions of instructions per se…
New screen packages are available for Slackware 15.0 and -current to fix security issues.
PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation. (CVE-2025-4207) References: - https://bugs.mage…
Multiple vulnerabilities were found in rubygems, which contains a package management framework for Ruby and a dependency manager for Ruby applications. CVE-202…
An update that fixes one vulnerability is now available.
