Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
It was discovered that nghttp2, an implementation of the HTTP/2 protocol, could be crashed via an assertion failure. A remote attacker could exploit this to ca…
It was discovered that PyJWT, a Python implementation of JSON web tokens insufficiently validated the "crit" header parameter, which could result in incomplete…
Cumulative bug-fix release from upstream. Includes fix for a possible SQL- injection issue via mod_sql (CVE-2026-42167). Note that mod_sql is not enabled by de…
Cumulative bug-fix release from upstream. Includes fix for a possible SQL- injection issue via mod_sql (CVE-2026-42167). Note that mod_sql is not enabled by de…
Cumulative bug-fix release from upstream. Includes fix for a possible SQL- injection issue via mod_sql (CVE-2026-42167). Note that mod_sql is not enabled by de…
A lot of Linux attacks now look like normal admin activity. Attackers use SSH , cron , curl , systemd , cloud scripts, and other trusted tools that defenders a…
Just weeks after Linux defenders began responding to Copy Fail , researchers have disclosed another serious privilege escalation vulnerability that can deliver…
It was discovered that PyJWT, a Python implementation of JSON Web Token did not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When…
Three security vulnerabilities were discovered in libexif, a library to reads and writes EXIF metainformation from and to images files, that can causes crashes…
In yet another software supply chain attack, threat actors have managed to compromise the popular Python package Lightning to push two malicious versions to co…
2026/03/24: fix missing fclose and potential double free in option file parsing 2026/03/23: upnphttp.c: fix removal of quotes in ParseHttpHeaders() minixml.c: …
Most information security best practices are built on a single, comfortable assumption: that if we find a bug, we can patch it, and once it's patched, the syst…
Think about Linux security like the structural integrity of a building. Most information security best practices focus on the front door''locks, cameras, and I…
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help …
CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode CVE-2026-35388: Add connection multiplexing confirmation for …
CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode CVE-2026-35388: Add connection multiplexing confirmation for …
Containers were sold on the promise of container isolation. Think of them like clean, separate rooms in a house where nothing leaks from one room to another. M…
Cybersecurity researchers have discovered a critical "by design" weakness in the Model Context Protocol's (MCP) architecture that could pave the way for remote…
The National Institute of Standards and Technology (NIST) has announced changes to the way it handles cybersecurity vulnerabilities and exposures (CVEs) listed…
LibRaw 0.22.1 and rebuilds Release 3.1.12.0 (Apr 1, 2026) -- compared to 3.1.11.0 oiiotool: Better type understanding with -i:ch= and other cleanup #5056 textu…
LibRaw 0.22.1 and rebuilds Release 3.1.12.0 (Apr 1, 2026) -- compared to 3.1.11.0 oiiotool: Better type understanding with -i:ch= and other cleanup #5056 textu…
OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user da…
1.6.56 is release fixes for the following two security vulnerabilities: CVE-2026-33416 (high severity): Use-after-free memory bug in the transparency and palet…
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new phishing campaign in which the cybersecurity agency itself was imperso…
