Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization contro…
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerabili…
A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google. Google say…
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882…
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute…
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer sessio…
Lukas Brandt writes: Criminals using the Amadey malware lost control of about 180,000 infected computers after operators from the Australian Signals Directorat…
Microsoft has resolved a known issue that prevents non-admin users from connecting to devices via Remote Desktop when the "Administrator protection" security f…
authd could allow unauthorized access to another user's files under certain circumstances.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them…
Multiple security issues were discovered in Caddy, a web server with automatic HTTPS, which may result in the bypass of path- or host-based access controls, th…
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon fu…
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the B…
Multiple vulnerabilities have been found in PHP, the worst of which could result in remote code execution.
This update blocks compromised intermediate certificates issued by the eMudhra CA. Most users will have these certs already blocked by the OneCRL feature provi…
Ellie Ng reports: More NHS staff have been dismissed for inappropriately accessing medical records of the Nottingham stabbing victims, taking the total sacked …
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remo…
AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CE…
A vulnerability was discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution. For the stable distributi…
Go could allow unintended access to network services.
Multiple vulnerabilities were discovered in MariaDB, a SQL database server compatible with MySQL. An authenticated attacker may perform denial-of-service, unau…
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrat…
Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its artificia…
Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted …
