Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Plan Linux log management around the records needed to investigate a break-in or an unauthorized change.
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw tha…
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026.…
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The acti…
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind fo…
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware …
The banned items — a wireless video transmitter and dashboard camera — are made with chips manufactured by Huawei subsidiary HiSilicon, which markets its produ…
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027.…
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its …
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has…
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo A…
In an era of hybrid threats, the British government wants to update the Submarine Telegraph Act 1885, which carries a maximum fine of £1,000 and five years’ im…
Nationwide lab test company Quest Diagnostics said one of its key systems may have experienced a breach of patient data.
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severit…
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new i…
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics…
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to …
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security fi…
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Th…
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botne…
The headline-grabbing bugs known colloquially as PHP2Shell are giving cyber analysts a lot to track — and a lot to debunk.
Ads in ChatGPT are chosen in part based on the conversation they appear under, and Meta now shapes the ads users see on Facebook and Instagram through conversa…
Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlie…
PHP has released emergency updates for two critical vulnerabilities that can let attackers run malicious code on a web server without logging in.
