Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets
Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors.…
Ubuntu 23 Python Security Random Essentials Addressing Buffer Overflow
0.011 - Update data pointer on resize for rdrand; Clean up string length handling 0.010 - Disallow requesting strings with negative lengths CVE-2026-2597; Try …
Fedora 43 perl-Crypt-SysRandom-XS Important Heap Overflow CVE-2026-2597
0.011 - Update data pointer on resize for rdrand; Clean up string length handling 0.010 - Disallow requesting strings with negative lengths CVE-2026-2597; Try …
Debian 11 gnutls28 Critical Denial Of Service CVE-2025-9820 DLA-4492-1
Vulnerabilities were found in GnuTLS, a portable library which implements the Transport Layer Security and Datagram Transport Layer Security protocols, which m…
Debian 11 GLib2.0 DLA-4491-1 Multiple DoS Memory Issues CVE-2026-0988
Multiple issues were found in GLib, a general-purpose, portable utility library, that could lead to denial of service, memory corruption or potentially arbitra…
Debian LTS 11 nova Important Resize Safety Issue DLA-4486-1 CVE-2026-24708
Dan Smith discovered that nova, a cloud computing fabric controller, calls qemu-img without format restrictions for resize, which may result in unsafe image re…
Debian DSA-6145-1 Nova Image Resize Issue CVE-2026-24708
Dan Smith discovered that nova, a cloud computing fabric controller, calls qemu-img without format restrictions for resize, which may result in unsafe image re…
Ubuntu 25.10 nginx Critical Insertion Security Flaw USN-8038-1
nginx could be made to insert content into proxied server data.
Debian 11 rlottie Critical Boundary Check Issue DLA-4474-1 CVE-2025-0634
Several issues have been found in rlottie, a library for rendering vector based animations and art. Most of these CVEs have been already fixed by Fix-crash-on-…
Malicious NGINX Configurations Enable Large-Scale Web Traffic Hijacking Campaign
Cybersecurity researchers have disclosed details of an active web traffic hijacking campaign that has targeted NGINX installations and management panels like B…
Survey of 100+ Energy Systems Reveals Critical OT Cybersecurity Gaps
A study by OMICRON has revealed widespread cybersecurity gaps in the operational technology (OT) networks of substations, power plants, and control centers wor…
Critical Grist-Core Vulnerability Allows RCE Attacks via Spreadsheet Formulas
A critical security flaw has been disclosed in Grist‑Core, an open-source, self-hosted version of the Grist relational spreadsheet-database, that could result …
Debian 11: DLA-4443-1 DCMTK Important MemCorruption SegFault CVE-2025-14607
Two vulnerabilities have been addressed in DCMTK, a collection of libraries and applications implementing large parts of the DICOM standard for medical images.…
MongoDB 8.2: Memory Leak Risk CVE-2025-14847 Critical Exploit
MongoBleed, tracked as CVE-2025-14847, is a high-severity flaw in MongoDB that allows unauthenticated attackers to read small pieces of a server's memory. In s…
MongoBleed MongoDB Memory Leak Under Active Exploitation Distros Lag on Updates
MongoBleed, tracked as CVE-2025-14847, is a high-severity flaw in MongoDB that allows unauthenticated attackers to read small pieces of a server's memory. In s…
ThreatsDay Bulletin: GhostAd Drain, macOS Attacks, Proxy Botnets, Cloud Exploits, and 12+ Stories
The first ThreatsDay Bulletin of 2026 lands on a day that already feels symbolic — new year, new breaches, new tricks. If the past twelve months taught defende…
MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide
A recently disclosed security vulnerability in MongoDB has come under active exploitation in the wild, with over 87,000 potentially susceptible instances ident…
Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors
In December 2024, the popular Ultralytics AI library was compromised, installing malicious code that hijacked system resources for cryptocurrency mining. In Au…
Debian LTS: postgresql-13 Critical DoS Integer Wraparound CVE-2025-12817
A couple of vulnerabilities were discovered in postgresql-13, the widely-popular database management system: CVE-2025-12817 Missing authorization in PostgreSQL…
Debian 11: glib2.0 Important Denial of Service Fix DLA-4412-1 CVE-2025-4373
Multiple issues were found in GLib, a general-purpose, portable utility library, that could lead to denial of service, memory corruption or potentially arbitra…
ThreatsDay Bulletin: AI Malware, Voice Bot Flaws, Crypto Laundering, IoT Attacks — and 20 More Stories
Hackers have been busy again this week. From fake voice calls and AI-powered malware to huge money-laundering busts and new scams, there’s a lot happening in t…
Qilin Ransomware Combines Linux Payload With BYOVD Exploit in Hybrid Attack
The ransomware group known as Qilin (aka Agenda, Gold Feather, and Water Galura) has claimed more than 40 victims every month since the start of 2025, barring …
Debian 11: libphp-adodb Important SQL Injection Advisory DLA-4340-1
libphp-adodb, a class library that provides abstractions for performing queries and managing databases, was affected by a vulnerability. Improper escaping of a…
What is an Out-of-Bounds Write Linux Security Vulnerability?
It starts as an innocuous bug. A developer miscalculates an offset, a boundary check is missing, a buffer is too small''just a simple oversight in code. But in…