Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last we…
Debian Telegram Desktop Fixes IPC Injection Vulnerability in DLA-4886-1
BeakSec discovered that Telegram Desktop, a fast and secure messaging application, contains an IPC record-separator injection vulnerability. It allows a remote…
Debian LibreOffice Fixes dBASE File Code Execution Risk
A buffer overflow was discovered in the handling of dBASE database files in LibreOffice, which could potentially result in the execution of arbitrary code. For…
Debian Puppet Agent Update Addresses Server Code Execution Flaws
It was discovered that missing validation of event data in the agent of the Puppet configuration management system could result in code execution on the Puppet…
Debian Puppet Agent Update Blocks Server Code Execution
It was discovered that missing validation of event data in the agent of the Puppet configuration management system could result in code execution on the Puppet…
The 4 Elements of Exposure Prioritization and How to Operationalize Them
Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attacke…
Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.…
Fedora 45 perl-DBI Update Fixes Crashes and Memory Corruption
Changes for version 1.656 Remove lock file on end of scope Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann) Memory corruption via selectrow_array…
Fedora 45 Aegisub 3.5.0 Blocks Crafted Subtitle Script Execution
Update to Aegisub 3.5.0, fixing CVE-2026-92705: arbitrary code execution when opening crafted ASS subtitle files containing associated Automation script refere…
Limited reports of PHP bug exploitation emerge
One cyber firm listed a half-dozen exploitations of the PHP2Shell bugs, and another identified a well targeted, suspected Chinese campaign that breached U.S. "…
Brotli Flaw Is Being Used in Attacks
Attackers are exploiting a flaw in Brotli, Google's software for unpacking compressed data.
Even after PHP2Shell, blast radius matters more than a CVSS score
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting…
Fedora 43 perl-DBI Fixes Crashes and Prevents Memory Corruption
Changes for version 1.656 Remove lock file on end of scope Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann) Memory corruption via selectrow_array…
Fedora 44 perl-DBI Update Fixes Crashes and Memory Issues
Changes for version 1.656 Remove lock file on end of scope Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann) Memory corruption via selectrow_array…
MCP Security Flaw in Google Toolbox Could Expose Server Files
An MCP security flaw in Google's open-source Toolbox for Databases could let an attacker copy files off the server running it or replace files on that machine.
Debian Valkey Update Blocks Denial of Service and Code Execution
Several vulnerabilities were discovered in Valkey, an in-memory key-value database. These issues could cause denial of service and, in some cases, potentially …
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.…
Debian LTS PHP 8.2 Fixes Critical Request Handling Flaws
Two critical vulnerabilities were found in PHP, a widely-used open source general purpose scripting language, which could result in remote execution of arbitra…
Fedora 43 webkitgtk Important Security Update CVE-2026-84635 CVE-2026-64753
Update to 2.54.1: Allow pasting in-memory image data from clipboard. Add User-Agent quirk for Amazon Luna. Align the filter surface with the device pixel grid.…
Debian 12 gst-plugins-bad1.0 Important DoS Memory Leak Attacks DLA-4839-1
Several vulnerabilities were discovered in gst-plugins-bad1.0, a collection of plugins for the GStreamer multimedia framework. Processing specially crafted med…
NGINX Vulnerability Fixes Require More Than a Version Check
NGINX has patched flaws that could let request data bypass a size limit or allow an encrypted session to be forged.
Curl Vulnerability Can Let a Malicious Server Run Code During Uploads
A curl vulnerability can let a malicious upload server run commands on the computer sending it data.
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows develo…
Debian mariadb Critical Unauthorized Access Denial of Service DLA-4835-1
Multiple vulnerabilities were discovered in MariaDB, a SQL database server compatible with MySQL. An authenticated attacker may perform denial-of-service, unau…