Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhe…
Update the rustls-webpki crate to version 0.103.16. Update the webpki-roots and webpki-root-certs crates to version 1.0.10. This addresses security advisories …
Update the rustls-webpki crate to version 0.103.16. Update the webpki-roots and webpki-root-certs crates to version 1.0.10. This addresses security advisories …
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault,…
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. This also leak …
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. This also leak …
California Attorney General Rob Bonta announced a settlement under which 23andMe's successor will pay $6 million to resolve allegations that the company did no…
Debra Ahmed reports: An unprotected database linked to India-based AI software development and IT services company Vibetech exposed 13.7 million records contai…
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Gri…
UpGuard provides another entry for our “No need to hack when it’s leaking” files. This time, it’s Liberating Research. On August 31, Greg Pollock from UpGuard …
A report by a Labour MP and an academic argues that if the British public cannot see what Russian activity costs, it cannot weigh that burden against the cost …
Several vulnerabilities were discovered in node-lodash, a Node.js module providing utility functions for common programming tasks. CVE-2025-13465 Prototype pol…
Several vulnerabilities have been discovered in the WebKitGTK web engine, that may lead to heap corruption, local privilege escalation, remote code execution, …
Catalyst::Plugin::Static::Simple for Perl sets the Cache‑Control header to "public" for every static asset served. Consequently, intermediaries such as shared …
The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based ut…
Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-inte…
A Linux host intrusion prevention system can fail even when the protected server still has spare CPU. If its logging path cannot record and move events as quic…
Using a proxy on Linux changes how web traffic reaches its destination, but it does not automatically protect every part of the connection. DNS requests may st…
Ubuntu released a security notice for vulnerabilities in the linux-fips kernel affecting Ubuntu 16.04 LTS, urging users to update their systems to mitigate pot…
Ubuntu 24.04 LTS received an update fixing multiple Linux kernel vulnerabilities, potentially compromising system security. Users are advised to update and reb…
A security update for Ubuntu 14.04 LTS addresses multiple vulnerabilities in the Linux kernel, potentially allowing system compromise. Users should update and …
A security update for SUSE Linux addresses 59 vulnerabilities, including fixes for memory leaks, out-of-bounds access, and potential crashes, urging immediate …
Multiple vulnerabilities in the Caddy web server can lead to unauthorized access and other security issues; users are urged to upgrade to version 2.6.2-12+deb1…
Not every security incident begins with sophisticated malware or a compromised server. Sometimes it is nothing more than a developer pushing code before the en…
