Practical security and development insights for builders and defenders.

By Gowri Shankar Balasubramaniam, it application security manager

FinTech & Payments 30 October 2026

Novalnet Releases Payment Plugin Version 13.6.3 for Shopware 6: Enhanced Invoicing and Expanded Payment Capabilities

Novalnet has released payment plugin version 13.6.3 for Shopware 6.7.0.0–6.7.5.1, introducing enhanced ZUGFeRD invoice generation with transaction details, updated iDEAL | Wero branding, and the removal of Payconiq. The latest release continues to support more than 25 international and regional payment methods, alongside comprehensive transaction management, automated payment processing, and refund capabilities for Shopware merchants.

6 min read

Vulnerability Analysis 28 Oct 2026

Node2Shell (CVE-2026-111497): What It Is and How to Fix It

Node2Shell (CVE-2026-111497) is a critical out-of-bounds write in the Brotli decoder bundled with Node.js. Learn how it works, who is exposed through Express 5 and fetch(), how to detect vulnerable assets, and how to patch.

11 min read

Vulnerability Analysis 28 Oct 2026

CVE-2026-1928: Rank Math SEO PHP Object Injection Leads to Remote Code Execution

CVE-2026-1928 is a high-severity (CVSS 8.8) PHP Object Injection flaw in the Rank Math SEO WordPress plugin, versions 1.0.276 and earlier. Any user with Contributor access can abuse the updateMeta REST API endpoint to inject a serialized object, write a webshell and take over the site. Here is how to detect and fix it.

6 min read

FinTech & Payments 27 Oct 2026

Bulgaria Euro Adoption 2026: What you should to know

Bulgaria adopted the euro on 1 January 2026 at a fixed rate of 1.95583 leva per euro, and the euro has been its only legal tender since 1 February 2026. This guide explains the key dates, how to exchange leftover leva, and what the changeover means for businesses, payments and PSPs.

11 min read

Server Security 23 Oct 2026

Secure SFTP Server Setup on Linux: How to Restrict Users to a Single Folder

This guide explains how to complete a secure SFTP server setup on Linux that restricts a user to a single folder using OpenSSH's ChrootDirectory and internal-sftp. It covers the exact commands, sshd_config settings, tests and hardening steps.

11 min read

Vulnerability Analysis 21 Oct 2026

PHP2Shell: CVE-2026-109618 and CVE-2026-109619 - Critical Unauthenticated RCE in PHP

PHP2Shell is a pair of critical vulnerabilities in the PHP runtime, rated CVSS v4.0 9.2, that let unauthenticated attackers execute code on web servers. Apache mod_php can be exploited before any application code runs. This advisory covers affected versions, how each attack chain works, patching, interim php.ini mitigations, detection and compliance impact.

11 min read Updated 23 Oct 2026

Vulnerability Analysis 19 Oct 2026

CVE-2026-109390: Critical AnyDesk Linux RCE - What It Is and How to Respond

CVE-2026-109390 is a critical (CVSS 9.8) flaw in AnyDesk for Linux 8.0.0–8.0.2 that lets unauthenticated attackers run code as root. Public exploit code is available. Learn which versions are affected, how to patch to 8.0.3, and how to detect signs of compromise.

4 min read

FinTech & Payments 16 Oct 2026

Secure Revenue with Novalnet: Payment Guarantee for Invoice and SEPA Direct Debit

The Novalnet payment guarantee is a service in which Novalnet AG, a BaFin-licensed payment institution, covers the risk of customer non-payment on approved invoice and SEPA Direct Debit orders. Merchants receive the full order amount even if the customer never pays. It applies to B2C customers in Germany, Austria and Switzerland and B2B customers in the EU and Switzerland, for EUR orders from EUR 9.99.

7 min read

Email Server 14 Oct 2026

Is Stalwart Better Than Zimbra? A Security-Focused Comparison

Stalwart or Zimbra? A security-focused comparison of architecture, exploitation history, licensing and cost, with a clear verdict on which self-hosted mail server to run in 2026.

8 min read

11 Oct 2026

Germany Arrests Alleged Qilin Ransomware Leader After Extradition

Germany has arrested an alleged core Qilin ransomware member extradited from Japan. Learn what it means for the RaaS threat and how to defend your organisation.

5 min read

Web Security 9 Oct 2026

Let's Encrypt Is Cutting Certificate Lifetimes to 64 Days: What It Means and How to Prepare

Starting February 10, 2027, Let’s Encrypt will issue 64-day certificates by default, with 45 days to follow in 2028. Most automated setups will be fine, but hardcoded renewal schedules, manual processes, and forgotten appliances will not. This post explains the change and how to prepare.

7 min read

Vulnerability Analysis 8 Oct 2026

CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

2 min read