Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
PHP has released emergency updates for two critical vulnerabilities that can let attackers run malicious code on a web server without logging in.
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-c…
A flaw at certificate authority eMudhra could let attackers create fake website certificates that some software would accept as real.
Several vulnerabilities were discovered in nginx, a high performance web and reverse proxy server. Depending on the configuration, these could result in memory…
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fix…
Two vulnerabilities were discovered in Django, the popular Python web-development framework. CVE-2026-77050 Potential denial-of-service vulnerability in get_su…
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attacke…
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content ma…
Update to 155.0.8059.39, includes 37 security fixes CVE-2026-110136: Use after free in PDF CVE-2026-110137: Use after free in WebRTC CVE-2026-110138: Use after…
Update to 155.0.8059.39, includes 37 security fixes CVE-2026-110136: Use after free in PDF CVE-2026-110137: Use after free in WebRTC CVE-2026-110138: Use after…
A vulnerability was discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution. For the stable distributi…
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a…
An attacker-written template can run commands on a web server under the conditions in an expanded Handlebars advisory.
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The cr…
Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its artificia…
A file on a build machine could end up in a cloud deployment bundle because of a flaw disclosed by Amazon Web Services (AWS) on Oct 8, 2026.
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web she…
A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address …
Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institut…
Update to 154.0.8037.92 * CVE-2026-102299: Type confusion in V8 * CVE-2026-102300: Uninitialized resource in WebGPU * CVE-2026-102301: Out of bounds write in G…
Multiple security vulnerabilities were discocered in the web UI of the SABnzbd+ binary news reader/grabber, which could result in the execution of arbitrary co…
Multiple vulnerabilities were discovered in Roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in cross-site scripting, se…
Update to 154.0.8037.92 * CVE-2026-102299: Type confusion in V8 * CVE-2026-102300: Uninitialized resource in WebGPU * CVE-2026-102301: Out of bounds write in G…
Update to 154.0.8037.92 * CVE-2026-102299: Type confusion in V8 * CVE-2026-102300: Uninitialized resource in WebGPU * CVE-2026-102301: Out of bounds write in G…
