Topic
11 articles
Node2Shell (CVE-2026-111497) is a critical out-of-bounds write in the Brotli decoder bundled with Node.js. Learn how it works, who is exposed through Express 5 and fetch(), how to detect vulnerable assets, and how to patch.
11 min read
CVE-2026-1928 is a high-severity (CVSS 8.8) PHP Object Injection flaw in the Rank Math SEO WordPress plugin, versions 1.0.276 and earlier. Any user with Contributor access can abuse the updateMeta REST API endpoint to inject a serialized object, write a webshell and take over the site. Here is how to detect and fix it.
6 min read
This guide explains how to complete a secure SFTP server setup on Linux that restricts a user to a single folder using OpenSSH's ChrootDirectory and internal-sftp. It covers the exact commands, sshd_config settings, tests and hardening steps.
11 min read
PHP2Shell is a pair of critical vulnerabilities in the PHP runtime, rated CVSS v4.0 9.2, that let unauthenticated attackers execute code on web servers. Apache mod_php can be exploited before any application code runs. This advisory covers affected versions, how each attack chain works, patching, interim php.ini mitigations, detection and compliance impact.
11 min read Updated
CVE-2026-109390 is a critical (CVSS 9.8) flaw in AnyDesk for Linux 8.0.0–8.0.2 that lets unauthenticated attackers run code as root. Public exploit code is available. Learn which versions are affected, how to patch to 8.0.3, and how to detect signs of compromise.
4 min read
Starting February 10, 2027, Let’s Encrypt will issue 64-day certificates by default, with 45 days to follow in 2028. Most automated setups will be fine, but hardcoded renewal schedules, manual processes, and forgotten appliances will not. This post explains the change and how to prepare.
7 min read
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
2 min read
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function.
2 min read
ShinyHunters claims it stole CyrusOne contracts, floor plans and access records. What the alleged breach means for data center operators and their tenants.
3 min read
Some budget Android phones are compromised before they leave the box. The Midnight Mimosa campaign puts malicious code directly into device firmware, where it gains system-level privileges, commits ad fraud, and turns phones into residential proxies. This post explains how the framework works, why it is a supply-chain risk for enterprises, and what users, security teams and procurement leaders should do.
7 min read
Learn how to check, install, and automate security updates on Ubuntu Linux servers using apt and unattended-upgrades
1 min read Updated
