Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The …
Version 0.18.1 - 2026-10-12 Security Fix heap buffer over-read in amqp_read_message when a content header frame with a non-basic class id is received; AMQP_STA…
Version 0.18.1 - 2026-10-12 Security Fix heap buffer over-read in amqp_read_message when a content header frame with a non-basic class id is received; AMQP_STA…
Attackers are exploiting a flaw in Brotli, Google's software for unpacking compressed data.
Changes for version 1.656 Remove lock file on end of scope Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann) Memory corruption via selectrow_array…
Changes for version 1.656 Remove lock file on end of scope Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann) Memory corruption via selectrow_array…
An MCP security flaw in Google's open-source Toolbox for Databases could let an attacker copy files off the server running it or replace files on that machine.
Avery Kreemer reports: Ohio Auditor Keith Faber announced that his office’s web server was attacked by “overseas cybercriminals and potentially foreign state a…
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Austr…
Several vulnerabilities were discovered in Valkey, an in-memory key-value database. These issues could cause denial of service and, in some cases, potentially …
In an unusual move, the suit — brought under the state’s deceptive trade practices laws — seeks to hold founder and CEO Sam Altman personally liable for the al…
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.…
Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network …
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware …
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks invol…
Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal sys…
The Cambridge Analytica data privacy scandal from a decade ago is still weighing on Meta's finances.
Version 3.3.11 (September 16, 2026) Changes Added menu items for moving column headers due to broken drag-and-drop in GTK Enabled fixed number of upload slots …
Two critical vulnerabilities were found in PHP, a widely-used open source general purpose scripting language, which could result in remote execution of arbitra…
Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templ…
California Attorney General Rob Bonta announced a settlement under which 23andMe's successor will pay $6 million to resolve allegations that the company did no…
A Nigerian national who worked with a group to hack tax prep businesses and conduct millions of dollars in fraud using customer data was sentenced this week.
WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who c…
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data …
