Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Fedora released an update for WordPress 6.9.5, addressing critical security vulnerabilities including SQL injection issues and potential remote code execution …
The Fedora update for nginx-mod-brotli version 1.0.0~rc-13 includes a rebuild for nginx version 1.30.4, addressing various CVEs and improving Brotli compressio…
Ubuntu released a security notice addressing vulnerabilities in the Linux kernel affecting versions 20.04 and 18.04, necessitating system updates and potential…
A security update addresses three vulnerabilities in jackson libraries affecting SUSE Linux Enterprise Server versions 16.0, enhancing protection from potentia…
ESET found 11 Microsoft-signed UEFI shims, some over a decade old, that let attackers bypass Secure Boot without a single new exploit.11 Old Signed UEFI Shims …
A 41-year-old former ransomware negotiator has been sentenced to nearly six years (i.e., 70 months) in prison in the U.S. for their role in conspiring with the…
A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritat…
A newly disclosed use-after-free in the Linux kernel's epoll code, CVE-2026-46242, lets an unprivileged user get root on affected Linux and Android systems. A …
A technical breakdown of how a VPN works: packet handling, protocol comparisons, DNS and WebRTC leak vectors, kill switch limitations, and why the enterprise V…
Multiple issues where found in u-boot, a cross-platform bootloader for embedded systems, which could lead to information leak and signature verification bypass…
CVE-2026-42530, the NGINX HTTP/3 vulnerability rated CVSS 9.2, is collecting dismissals because exploitation requires ASLR to be disabled or bypassed. Here is …
Metric names and values are now validated to ensure they do not contain characters below ASCII 32 (including newlines), colon (":") or pipe ("|") characters th…
Metric names and values are now validated to ensure they do not contain characters below ASCII 32 (including newlines), colon (":") or pipe ("|") characters th…
Privilege escalation is the pivot point in almost every serious intrusion. This guide explains where it fits in the attack chain, the tooling attackers use, an…
Remote access tools do not need dramatic new features to improve security. Sometimes the more useful change is quieter, like stronger defaults that make weak e…
CVE-2026-0257's GlobalProtect authentication bypass went from advisory to active exploitation in four days. The recurring pattern of perimeter device failures …
An AUR supply chain attack compromised more than 400 Arch Linux packages from 11 June 2026, planting a Rust credential stealer and an eBPF rootkit that hides f…
Cybersecurity researchers have warned of a "resurgence and expansion" of JDY, a covert network associated with China-nexus state-sponsored threat actors."The J…
Multiple vulnerabilities have been discovered in the Apache HTTP server, which may result in remote code execution, privilege escalation, denial of service or …
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Tr…
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Tr…
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Tr…
Tails 7.7 doesn't ship new features. It surfaces a trust problem that's been sitting quietly in Secure Boot chains for years: the digital certificates that all…
You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. S…
