Analysis of important vulnerabilities and CVEs: what was affected, which versions fix them and how to protect your systems.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOn SonicWall firewalls that use SAML for SSL VPN, attackers with stolen credentials could skip SAML checks — including MFA. Fixed firmware and what to do.
Read articleA flaw in how OpenSSH handles locked accounts on musl-based systems was exploited within two days of the fix. Who is affected and what to check.
Read articleTwo critical remote code execution flaws in PHP itself, CVSS 9.2. Fixed versions, temporary protections and how to check your servers.
Read articleIn 2026 nginx.org has published 26 advisories, including two rated “major”. The safe versions now are 1.31.7 and 1.30.6.
Read articleShell, Mark-of-the-Web and NTLM flaws were exploited before or soon after patches this year. A short overview and the protections that help against the whole class.
Read articleThree RouterOS vulnerabilities are already used in attacks. Which RouterOS versions are safe and how to lock down management access.
Read articleA critical authentication bypass in FortiOS, FortiManager, FortiAnalyzer and other Fortinet products was exploited in the wild. Fixed versions and checks.
Read articleA deserialization flaw in WSUS allowed unauthenticated code execution. The first fix was incomplete; an emergency update followed after attacks began.
Read articleTwo chained flaws in Cisco firewall VPN services were exploited before patches existed, prompting an emergency directive. What owners of Cisco ASA should check.
Read articleA zero-day in on-premises SharePoint let attackers run code and steal server keys. Why patching had to be followed by rotating machine keys.
Read articleAn authentication bypass in a plugin installed on about 4 million WordPress sites. Ironically, it affected sites that had turned on two-factor authentication.
Read articleA critical flaw in a popular backup server allowed code execution without a password and was used by ransomware groups. How to protect the backup system itself.
Read articleA weak security hash in a caching plugin used on millions of sites allowed unauthenticated privilege escalation. Update and check your admin users.
Read articleA PHP object injection in a popular donation plugin let unauthenticated attackers run code and delete files. What site owners should do.
Read articleSpecially crafted IPv6 packets could run code on any Windows machine with IPv6 enabled — no login, no user action. Patch first; disabling IPv6 was only a fallback.
Read articleAn old bug returned to OpenSSH and allowed unauthenticated code execution as root on Linux servers. Why SSH should never be wide open.
Read articleAn XML external entity flaw in Adobe Commerce and Magento Open Source let attackers steal secret keys and, combined with another bug, run code. Patching alone was not enough.
Read articleCommand injection in the VPN feature of PAN-OS allowed attackers to run commands as root on the firewall itself. What to learn about edge devices.
Read articleA backdoor was hidden in a compression library used by Linux SSH servers. It was found by chance before reaching most stable systems. What it teaches about trust in software.
Read articleAn out-of-bounds write in the FortiGate SSL VPN let unauthenticated attackers run code, and it was exploited in the wild. Versions to install and what to do if you cannot update.
Read articleTwo chained flaws gave attackers full control of Ivanti VPN gateways. Why a factory reset was recommended even after patching.
Read articleA memory leak in NetScaler let attackers copy logged-in sessions. Why patching alone was not enough and what to do after a VPN gateway flaw.
Read articleA SQL injection in a managed file transfer product let a ransomware group steal data from hundreds of organizations. What it teaches about file exchange systems.
Read articleAn improper access check in Joomla 4 web service endpoints let anyone read the site configuration — including database credentials.
Read articleA zero-day in Confluence Server and Data Center let anyone run code on the server. Internal knowledge bases are rarely treated as critical — they should be.
Read articleAttackers abused the Microsoft Support Diagnostic Tool through Office documents. No macros, sometimes not even opening the file was needed.
Read articleOne line of text in a log could give attackers full control of a server. Why Log4Shell still matters and how to make sure you are protected.
Read articleWrong permissions on Windows registry files let normal users read password hashes through shadow copies. Installing the update alone was not enough.
Read articleA flaw in the Windows Print Spooler allowed code execution with SYSTEM rights, including on domain controllers. Why the print service should be off where it is not needed.
Read articleA chain of Exchange Server flaws let attackers take over mail servers without a password. Lessons for anyone still running Exchange on-premises.
Read articleA two-year-old fix that many hosts never installed. In February 2023 the ESXiArgs ransomware encrypted thousands of exposed ESXi servers.
Read articleA file manager plugin with about 700,000 installations allowed unauthenticated file upload and code execution. A classic lesson about risky plugins.
Read articleA cryptographic flaw in the Netlogon protocol let an attacker on the network become domain administrator. Why domain controllers must be patched first.
Read articleThree years after EternalBlue, a new SMB vulnerability with a maximum score affected Windows 10. Patch, and keep port 445 closed to the internet.
Read articleA flaw in Windows certificate validation, reported by the NSA, let attackers forge code signatures and HTTPS certificates.
Read articleA path traversal in Citrix ADC let attackers run code without logging in. Patches took a month — mitigation steps were the only defence in the meantime.
Read articleA pre-authentication bug in Remote Desktop Services was so serious that Microsoft even patched Windows XP. Why RDP must never face the internet.
Read articleAn unauthenticated file read on Pulse Connect Secure exposed cleartext credentials. Organizations that patched but did not reset passwords stayed compromised.
Read articleA Winbox flaw let attackers download the router's user database. Years later, unpatched routers were still being hijacked for cryptomining and botnets.
Read articleA flaw in Drupal's form handling let anyone run code on millions of Drupal sites. It is still scanned for today.
Read articleMicrosoft patched it in March 2017. Two months later, WannaCry hit unpatched networks worldwide. The lessons still apply to every office network.
Read articleTell us about your infrastructure and goals. We'll get back to you within one business day with next steps.
