Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Composer, an application-level dependency manager for the PHP programming language was vulnerable. CVE-2023-43655:
It was discovered that composer, a dependency manager for the PHP language, processed files in the local working directory. This could lead to local privilege …
Two security vulnerabilities have been discovered in Wordpress, a popular content management framework, a PHP File Upload bypass via the plugin installer and a…
A critical security flaw in the Bricks theme for WordPress is being actively exploited by threat actors to run arbitrary PHP code on susceptible installations.…
It was discovered that phpseclib, a PHP library for arbitrary-precision integer arithmetic, was vulnerable to the so-called Terrapin Attack. The SSH transport …
WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to exe…
Security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in information disclosure, denial of servic…
Recently disclosed security flaws impacting Juniper firewalls, Openfire, and Apache RocketMQ servers have come under active exploitation in the wild, according…
Multiple security vulnerabilities were found in symfony, a PHP framework for web and console applications and a set of reusable PHP components, which could lea…
XSS in phoromatic_r_add_test_details.php (CVE-2022-40704) References: - https://bugs.mageia.org/show_bug.cgi?id=31423 - https://lists.fedoraproject.org/archive…
It was discovered that there was a potential cross-site scripting vulnerability in smarty3, a widely-used PHP templating engine. For Debian 10 buster, this pro…
It was discovered that there was a potential arbitrary file read vulnerability in twig, a PHP templating library. It was caused by insufficient validation of t…
Several security vulnerabilities have been discovered in smarty3, the compiling PHP template engine. Template authors are able to run restricted static php met…
Update to 21.08.8 to fix CVE-2022-29500, CVE-2022-29501, and CVE-2022-29502. https://www.schedmd.com/news.php?id=260#OPT_260
Update to 21.08.8 to fix CVE-2022-29500, CVE-2022-29501, and CVE-2022-29502. https://www.schedmd.com/news.php?id=260#OPT_260
Update to 21.08.8 to fix CVE-2022-29500, CVE-2022-29501, and CVE-2022-29502. https://www.schedmd.com/news.php?id=260#OPT_260
Emmet Leahy reported that libphp-adodb, a PHP database abstraction layer library, allows to inject values into a PostgreSQL connection string. Depending on how…
CloudLinux's security platform for Linux-based websites and web servers contains a high-severity PHP deserialization bug, leaving web servers vulnerable to cod…
An out-of-bounds read and write flaw was discovered in the PHP-FPM code, which could result in escalation of privileges from local unprivileged user to the roo…
An out-of-bounds read and write flaw was discovered in the PHP-FPM code, which could result in escalation of privileges from local unprivileged user to the roo…
An out-of-bounds read and write flaw was discovered in the PHP-FPM code, which could result in escalation of privileges from local unprivileged user to the roo…
Several vulnerabilities were discovered in smarty3, a template engine for PHP. CVE-2018-13982
It was discovered that there was a use-after-free vulnerability when parsing PHAR files, a method of putting entire PHP applications into a single file.
A security researcher earlier today publicly revealed details and proof-of-concept exploit code for an unpatched, critical zero-day remote code execution vulne…
