News feed
Topics
23 items · Page 1 of 2
Analysis · Security
How CVE-2026-109618 and CVE-2026-109619 work, why a PHP version check misleads, what the four-day exploitation puzzle means, and how to test your servers.
Analysis · AI
robots.txt only stops polite crawlers. Here is how user-agent rules, Web Bot Auth signatures, rate limits and login gates compare for AI agents, and what each one misses.
Analysis · Security
How to prove a Magento or Adobe Commerce store is patched, hunt for webshells and tampered templates, and roll out the BlockStrap fix without breaking the storefront.
Brief · Security
CVE-2026-103849, a maximum-severity flaw in Magento and Adobe Commerce, could let attackers run arbitrary PHP on store servers. Researchers warn exploitation could come soon.
Brief · Security
Candiru spyware reached devices at Al Jazeera Media Network through targeted online ads. The attack needed only that the malicious ad be rendered, with no click.
Analysis · Security
The first 72 hours after an actively exploited VPN, gateway or firewall zero-day: exposure scans, log checks, config diffs, containment gates and the evidence to keep.
Analysis · AI
C2PA manifests and audio watermarks are meant to label AI-generated sound and video. Here is how each one is embedded and verified, and where each one breaks.
Analysis · Security
A tag is a label anyone with push rights can rewrite. Here is how to pin by digest, verify signatures, and audit registry tokens after the Docker Hub flaw CVE-2026-105445.
Analysis · Security
A repeatable method for ranking Patch Tuesday CVEs by known exploitation, exploit likelihood and asset exposure, worked through October 2026's record batch.
Brief · Security
The US Justice Department arrested two suspects, charged 14 people and seized nearly 187 laptops tied to North Korean remote IT worker schemes. The Famous Chollima group is named.
Brief · World
Ukraine says Starlink access has improved but speed limits still disrupt battlefield missions. Musk says any limits are down to the US government, not his firm.
Analysis · Security
Ghostscript’s CVE-2026-39919 is the trigger. The lasting question: what SAFER, permit lists, containers, resource limits and patching each stop in a PDF converter, and what they miss.