Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
An update for collectl, a Linux performance data utility, addresses insecure code handling and upgrades to version 4.3.20.3, available for installation via the…
It was discovered that there was a potential buffer overflow in xz-utils, a popular data-compression utility and library. CVE-2026-34743 If the lzma_index_deco…
A cloud tenant using nothing but ordinary GPU access can push a data center's power draw up and down fast enough to threaten the grid it runs on, with no explo…
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this mont…
A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out …
Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archi…
Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines…
Backport fixes for CVE-2026-48858 (ftp SSRF), CVE-2026-49759 (SCTP DoS), CVE-2026-48860 (dist-over-TLS auth bypass), CVE-2026-54886 (ssh SFTP DoS), CVE-2026-54…
Backport fixes for CVE-2026-48858 (ftp SSRF), CVE-2026-49759 (SCTP DoS), CVE-2026-48860 (dist-over-TLS auth bypass), CVE-2026-54886 (ssh SFTP DoS), CVE-2026-54…
Update python-django5 to version 5.2.16 Fixes three low-severity CVEs CVE-2026-48588: Potential exposure of private data via cached Set-Cookie response CVE-202…
Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
For years, we secured our Linux infrastructure by building walls: VPCs, security groups, and hardened SSH configurations. We treated the cloud like a virtual d…
Proxies are a standard component of a Linux administrator's toolbox. You can use them to see how services respond in various locations, to run route monitoring…
Two vulnerabilities were discovered in dhcpcd5, a DHCP client, which may result in denial of service and possibly data corruption. For Debian 11 bullseye, thes…
AI security agents are starting to influence real security decisions. They summarize findings, prioritize remediation, recommend next steps, and help teams mov…
Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without expl…
It was discovered that there were two issues in Redis, the in-memory key/value database: CVE-2026-23631 An authenticated attacker could have exploited the mast…
Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from compromised systems…
There was a time when Linux meant server rooms and hobbyist forums. These days it's on regular laptops, and a big part of that is people getting fed up with co…
A vulnerability has been found in the mesa 3D graphics library, possibly allowing out of bound memory access by craftet input. CVE-2026-40393 An out-of-bounds …
Researchers at firmware security firm Binarly have found six new flaws in U-Boot, the small program that starts up hardware as varied as home routers, smart ca…
Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are setting off detection rules …
A recent EvilTokens campaign targeting businesses across the US and Europe is exposing a new email security blind spot. This “ghost phishing” technique keeps t…
Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in P…
