Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service or potentially the execution of ar…
MongoBleed, tracked as CVE-2025-14847, is a high-severity flaw in MongoDB that allows unauthenticated attackers to read small pieces of a server's memory. In s…
MongoBleed, tracked as CVE-2025-14847, is a high-severity flaw in MongoDB that allows unauthenticated attackers to read small pieces of a server's memory. In s…
net-snmp is a SNMP application library, tools and daemon. A specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon…
Support for Go 1.26 and security fixes. Upstream release notes.
Support for Go 1.26 and security fixes. Upstream release notes.
Two vulnerabilities were discovered in php-dompdf, a PHP library to convert HTML to PDF. CVE-2021-3838 php-dompdf is vulnerable to PHAR deserialization due to …
The threat actor known as Silver Fox has turned its focus to India, using income tax-themed lures in phishing campaigns to distribute a modular remote access t…
AI didn't invent hacking, and it didn't make attackers smarter. It removed friction. Tasks that once required patience, focus, and a fair amount of context now…
Vulnerabilities were found in python-urllib3, an HTTP library with thread-safe connection pooling for Python, which could lead to denial of service or request …
A couple of vulnerabilities were discovered in postgresql-13, the widely-popular database management system: CVE-2025-12817 Missing authorization in PostgreSQL…
Release 1.6.12 Support IPv6 in database DSN (#9937) Don't force specific error_reporting setting Fix compatibility with PHP 8.5 regarding array_first() Remove …
Release 1.6.12 Support IPv6 in database DSN (#9937) Don't force specific error_reporting setting Fix compatibility with PHP 8.5 regarding array_first() Remove …
It was discovered that c-ares, a library that performs DNS requests and name resolution asynchronously, does not properly handle termination of queries which m…
The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes …
upstream stable upgrade from 2.41.1 to 2.41.3 (CVE-2025-14104 and other issues)
It was found that in node-url-parse, a Node.js module used to parse URLs, an incorrect conversion of `@` characters in protocol in the `href` field can lead to…
A path traversal vulnerability was identified in binwalk. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract f…
AI-assisted coding and AI app generation platforms have created an unprecedented surge in software development. Companies are now facing rapid growth in both t…
Multiple issues were found in GLib, a general-purpose, portable utility library, that could lead to denial of service, memory corruption or potentially arbitra…
The security vulnerability known as React2Shell is being exploited by threat actors to deliver malware families like KSwapDoor and ZnDoor, according to finding…
React2Shell is a server-side vulnerability that turns a normal web request into code execution. It allows unauthenticated remote code execution, without creden…
React2Shell is a server-side vulnerability that turns a normal web request into code execution. It allows unauthenticated remote code execution, without creden…
The pro-Russian hacktivist group known as CyberVolk (aka GLORIAMIST) has resurfaced with a new ransomware-as-a-service (RaaS) offering called VolkLocker that s…
