Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Security constraint bypass for CGI scripts. (CVE-2025-46701) References: - https://bugs.mageia.org/show_bug.cgi?id=34332 - https://openwall.com/lists/oss-secur…
New seamonkey packages are available for Slackware 15.0 and -current to fix security issues.
cifs.upcall makes an upcall to the wrong namespace in containerized environments. (CVE-2025-2312) References: - https://bugs.mageia.org/show_bug.cgi?id=34315
An Iran-aligned hacking group has been attributed to a new set of cyber attacks targeting Kurdish and Iraqi government officials in early 2024.The activity is …
New python3 packages are available for Slackware 15.0 and -current to fix security issues.
New curl packages are available for Slackware 15.0 and -current to fix security issues.
Alright, sysadmins and infosec pros, let's talk about Chaos RAT. If you haven't already crossed paths with this rather persistent piece of malware, it's time y…
IoT devices have always been a juicy target for attackers''they're often undersecured, overlooked, and ripe for exploitation. But here's where PumaBot, a Go-ba…
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is s…
Double free on init failure has been fixed in libvpx, a library for decoding and encoding VP8 and VP9 videos. For Debian 11 bullseye, this problem has been fix…
This update contains the backported fix for CVE-2024-52804 (cookie parsing DoS vuln).
This contains the backported fix for CVE-2024-52804 (cookie parsing DoS vuln)
The Qualys Threat Research Unit (TRU) discovered that systemd-coredump is prone to a kill-and-replace race condition which may allow a local attacker to gain s…
The threat actors behind the DragonForce ransomware gained access to an unnamed Managed Service Provider's (MSP) SimpleHelp remote monitoring and management (R…
A client-side desync vulnerability can be triggered in Varnish, a high-performance web accelerator. An attacker can abuse a flaw in Varnish¢''s handling of chu…
A client-side desync vulnerability can be triggered in Varnish, a high-performance web accelerator. An attacker can abuse a flaw in Varnish¢''s handling of chu…
Google on Wednesday disclosed that the Chinese state-sponsored threat actor known as APT41 leveraged a malware called TOUGHPROGRESS that uses Google Calendar f…
The update for net-tools announced in DSA 5923-1 introduced a regression for ifconfig always showing zero value packet counters. Updated packages are now avail…
New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues.
New curl packages are available for Slackware 15.0 and -current to fix security issues.
An Iranian national has pleaded guilty in the U.S. over his involvement in an international ransomware and extortion scheme involving the Robbinhood ransomware…
Sender Spoofing via Malformed From Header in Thunderbird. (CVE-2025-3875) Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:…
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*n…
VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to…
