Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Rebuild against idna 1.0+ for CVE-2024-12224
When people talk about open-source software, it often comes with a certain level of trust''trust in the community, trust in transparent development, and trust …
Microsoft has released patches to fix 67 security flaws, including one zero-day bug in Web Distributed Authoring and Versioning (WebDAV) that it said has come …
Secure Boot has long been advertised as the security boundary that keeps rogue software and untrusted code at bay during system startup. By checking cryptograp…
Kirill Firsov discovered that Roundcube, a skinnable AJAX based webmail solution for IMAP servers, was performing PHP Object deserialization on unvalidated inp…
Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump. (CVE-2025-4598) Referenc…
Security constraint bypass for CGI scripts. (CVE-2025-46701) References: - https://bugs.mageia.org/show_bug.cgi?id=34332 - https://openwall.com/lists/oss-secur…
cifs.upcall makes an upcall to the wrong namespace in containerized environments. (CVE-2025-2312) References: - https://bugs.mageia.org/show_bug.cgi?id=34315
IoT devices have always been a juicy target for attackers''they're often undersecured, overlooked, and ripe for exploitation. But here's where PumaBot, a Go-ba…
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is s…
This update contains the backported fix for CVE-2024-52804 (cookie parsing DoS vuln).
This contains the backported fix for CVE-2024-52804 (cookie parsing DoS vuln)
The threat actors behind the DragonForce ransomware gained access to an unnamed Managed Service Provider's (MSP) SimpleHelp remote monitoring and management (R…
A client-side desync vulnerability can be triggered in Varnish, a high-performance web accelerator. An attacker can abuse a flaw in Varnish¢''s handling of chu…
A client-side desync vulnerability can be triggered in Varnish, a high-performance web accelerator. An attacker can abuse a flaw in Varnish¢''s handling of chu…
Google on Wednesday disclosed that the Chinese state-sponsored threat actor known as APT41 leveraged a malware called TOUGHPROGRESS that uses Google Calendar f…
The update for net-tools announced in DSA 5923-1 introduced a regression for ifconfig always showing zero value packet counters. Updated packages are now avail…
Sender Spoofing via Malformed From Header in Thunderbird. (CVE-2025-3875) Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:…
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*n…
VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday revealed that Commvault is monitoring cyber threat activity targeting applications…
Imagine you're sitting down at your desk, coffee in hand, ready to tackle the day, and you're met with this: a new campaign, slyly dubbed ''ClickFix,'' is burr…
Modern apps move fast—faster than most security teams can keep up. As businesses rush to build in the cloud, security often lags behind. Teams scan code in iso…
Google on Wednesday released updates to address four security issues in its Chrome web browser, including one for which it said there exists an exploit in the …
