Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer data without eve…
Debian has released an advisory for OpenJDK-21 addressing multiple vulnerabilities that could lead to certificate validation issues, denial of service, or data…
A security update for curl version 8.15.0 on Fedora 43 addresses multiple vulnerabilities including information leaks and improper validation, enhancing the to…
The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA…
A security update for webkit2gtk3 addresses 23 vulnerabilities, including issues that could lead to arbitrary JavaScript execution, unexpected crashes, and dat…
A security update for webkit2gtk3 addresses 23 vulnerabilities affecting multiple SUSE and openSUSE versions, improving the handling of web content and prevent…
SUSE has released an important security update for webkit2gtk3, addressing 23 vulnerabilities, including issues with memory corruption, process crashes, and da…
The Fedora update for perl-Mojolicious version 9.48 addresses a security flaw related to CSRF tokens, enhancing protection against BREACH attacks by masking to…
The Fedora update for perl-Mojolicious 9.48 addresses a security issue with CSRF tokens vulnerable to BREACH attacks by masking tokens with a fresh random valu…
Multiple vulnerabilities in WebKitGTK have been identified, leading to process crashes, memory corruption, and potential data leaks; users are urged to upgrade…
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this mont…
A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out …
Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without expl…
Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from compromised systems…
If you’re relying on standard network logs to protect your Linux infrastructure, you’re flying blind. Most organizations believe they have network security mon…
It was discovered that beets, a media library management system, is vulnerable to run arbitrary JavaScript code in the victim browser, exfiltrate viewable data…
Breaches don't always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerabilit…
Ransomware still encrypts files with a hybrid AES/RSA scheme, but the data theft and backup destruction that happen before encryption are where modern attacks …
Authorities in Europe and North America have announced the dismantling of a criminal virtual private network (VPN) service used by criminal actors to obscure t…
OpenAI has disclosed that two of its employee devices in its corporate environment were impacted via the Mini Shai-Hulud supply chain attack on TanStack, but n…
Linux runs a massive part of the internet. Cloud platforms, databases, containers, web hosting, APIs, and internal business infrastructure all depend heavily o…
Cybersecurity researchers have disclosed details of a new credential theft framework dubbed PCPJack that targets exposed cloud infrastructure and ousts any art…
Three security vulnerabilities were discovered in libexif, a library to reads and writes EXIF metainformation from and to images files, that can causes crashes…
OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user da…
