security update

SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)

Don't miss, enterprise, Hot stuff, MSP, News, security update, SonicWall, vulnerability /

SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255) 2026-10-07 at 13:37 By Zeljka Zorz SonicWall has patched four vulnerabilities in its popular Secure Mobile Access (SMA) 1000 series of appliances, including one (CVE-2026-102255) that could allow remote unauthenticated attackers “to direct the appliance to issue requests on their behalf and reach internal functionality […]

SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255) Read More »

Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)

Don't miss, Hot stuff, Microsoft Exchange, News, security update, vulnerability /

Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940) 2026-10-05 at 13:38 By Zeljka Zorz Microsoft has pushed out an out-of-band security update for Exchange Server that fixes a high-severity vulnerability (CVE-2026-96940) that may allow authenticated attackers to read emails and attachments of other users in the same organization, but “does not allow access […]

Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940) Read More »

Ubuntu kernel CVE fixes are moving to a weekly release schedule

CVE, Linux, News, security update, Ubuntu /

Ubuntu kernel CVE fixes are moving to a weekly release schedule 2026-09-24 at 07:27 By Anamarija Pogorelec Ubuntu kernels will ship every week under a new release schedule from Canonical, which is merging its four-week cycle for regular Stable Release Updates (SRUs) and its two-week cycle for security fixes into a single two-week cycle. The […]

Ubuntu kernel CVE fixes are moving to a weekly release schedule Read More »

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

CMS, CVE, News, security update, WordPress /

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902) 2026-09-23 at 12:01 By Sinisa Markovic WordPress released version 7.1.2 to fix a critical flaw that lets an unauthenticated attacker make the software load a PHP file of the attacker’s choosing from outside the site’s active theme folders. On sites where the server and the active […]

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902) Read More »

Android apps can now check security patches down to individual device components

Android, cybersecurity, Google, News, patching, security update /

Android apps can now check security patches down to individual device components 2026-09-18 at 11:38 By Anamarija Pogorelec New AndroidX Security State libraries provide a more granular way to determine how securely patched an Android device is. The stable Security State v1.1.0 and Security State Provider v1.0.0 libraries allow developers to check the security status […]

Android apps can now check security patches down to individual device components Read More »

Homebrew 7.0.0 is out, here’s what changed for security

News, open source, security update, software /

Homebrew 7.0.0 is out, here’s what changed for security 2026-09-15 at 03:47 By Sinisa Markovic Homebrew installs command-line software and desktop applications from the terminal on macOS and Linux, and Mac developers use it to set up their machines. On Sunday the project shipped version 7.0.0 and closed eight security advisories with it. The most […]

Homebrew 7.0.0 is out, here’s what changed for security Read More »

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages

Debian, Linux, News, open source, security update /

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages 2026-09-14 at 10:40 By Sinisa Markovic The Debian project shipped Debian 13.7 codenamed “trixie.” The project folded in 92 security advisories it had already published separately, added corrections to 106 source packages, and rebuilt the installer around both. Six of the 92 advisories […]

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages Read More »

Jellyfin 12.0 security fixes arrive alongside the removal of legacy client logins

News, open source, security update, software /

Jellyfin 12.0 security fixes arrive alongside the removal of legacy client logins 2026-09-08 at 11:41 By Anamarija Pogorelec Jellyfin shipped version 12.0 of its media server. Several of the security fixes in it block requests built to reach files outside the folders the server is supposed to hand out. The rest of the security work […]

Jellyfin 12.0 security fixes arrive alongside the removal of legacy client logins Read More »

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)

Akamai, Don't miss, Ethiack, Hot stuff, News, Ruby on Rails, security update, tips, vulnerability, web application security /

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066) 2026-08-03 at 14:42 By Zeljka Zorz A critical security vulnerability (CVE-2026-66066) in Ruby on Rails (aka Rails), one of the most widely used frameworks for building websites and web apps, may allow attackers to read sensitive files off a server and, in some cases, take full control of […]

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066) Read More »

Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232)

Check Point, CISA, configuration management, Don't miss, firewall, Hot stuff, News, security update, vulnerability /

Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232) 2026-07-23 at 13:42 By Zeljka Zorz Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the management servers that push policy to Check Point security gateways (i.e., firewalls). “An unauthenticated attacker can obtain […]

Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232) Read More »

Two new high severity WordPress vulnerabilities, patch immediately!

CVE, cybersecurity, Don't miss, Hot stuff, News, Searchlight Cyber, security update, vulnerability, WordPress /

Two new high severity WordPress vulnerabilities, patch immediately! 2026-07-18 at 17:57 By Help Net Security The 7.0.2 WordPress security release addresses one critical and one high severity security issue. The vulnerabilities reported to the WordPress security team include: CVE-2026-60137 – A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo CVE-2026-60137 […]

Two new high severity WordPress vulnerabilities, patch immediately! Read More »

Microsoft demystifies how Windows updates work

cybersecurity, Don't miss, Hot stuff, Microsoft, News, Patch Tuesday, security update, Windows /

Microsoft demystifies how Windows updates work 2026-07-13 at 08:30 By Anamarija Pogorelec Microsoft has published a guide explaining the Windows servicing model, outlining the purpose of monthly security updates, optional preview releases, hotpatch updates, and the mechanisms used to deliver new features throughout the year. “Most individuals and organizations regularly deploy monthly security updates, released […]

Microsoft demystifies how Windows updates work Read More »

Debian 13.6 security update patches over a hundred advisories in trixie

Debian, Linux, News, operating system, security update /

Debian 13.6 security update patches over a hundred advisories in trixie 2026-07-13 at 01:25 By Anamarija Pogorelec Most PCs still run with a UEFI Secure Boot certificate authority, installed by default since 2013, that has now expired. That certificate signed the bootloaders letting machines start with Secure Boot turned on. Its expiry sits at the […]

Debian 13.6 security update patches over a hundred advisories in trixie Read More »

Microsoft is rewriting Windows patch guidance because of AI

AI, Don't miss, Microsoft, Microsoft 365, News, patching, security update, Windows /

Microsoft is rewriting Windows patch guidance because of AI 2026-07-10 at 09:00 By Anamarija Pogorelec Microsoft is recommending that organizations shorten Windows update deployment timelines, warning that advances in AI are reducing the time attackers need to identify and exploit vulnerabilities after security updates are released. The company says organizations should reassess how quickly they […]

Microsoft is rewriting Windows patch guidance because of AI Read More »

Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)

Don't miss, exploit, Hot stuff, Microsoft, Microsoft Defender, News, security update, vulnerability disclosure /

Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656) 2026-07-09 at 15:14 By Zeljka Zorz Microsoft has finally released a security update for its Microsoft Malware Protection Engine, which fixes CVE-2026-50656, the Windows Defender local privilege escalation vulnerability triggered by the RoguePlanet exploit. The vulnerability and the fix CVE-2026-50656 is due to improper link resolution before […]

Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656) Read More »

New ClamAV security patch closes seven scanner bugs dating back two decades

antivirus, Cisco, News, open source, scanner, security update, software /

New ClamAV security patch closes seven scanner bugs dating back two decades 2026-07-06 at 01:30 By Sinisa Markovic Open source antivirus scanning sits inside mail gateways, file upload checks, and endpoint tooling at organizations of every size. Much of that work runs through ClamAV, the scanning engine maintained by Cisco’s Talos group. The project released […]

New ClamAV security patch closes seven scanner bugs dating back two decades Read More »

Synology issues critical fix for MailPlus Server vulnerabilities

Don't miss, email security, Hot stuff, NAS, News, security update, SMBs, Synology, vulnerability /

Synology issues critical fix for MailPlus Server vulnerabilities 2026-06-26 at 13:57 By Zeljka Zorz Synology has has fixed critical vulnerabilities in MailPlus Server, a software package used to run private email infrastructure on Synology NAS devices. The security update fixes three flaws: CVE-2026-13136, stemming from faulty authorization checks, may allow remote attackers to read or […]

Synology issues critical fix for MailPlus Server vulnerabilities Read More »

Microsoft gives Windows 10 users an unexpected extra year of free security updates

Microsoft, News, security update, Windows /

Microsoft gives Windows 10 users an unexpected extra year of free security updates 2026-06-26 at 09:32 By Sinisa Markovic Microsoft has given Windows 10 users another year of free security updates, extending its consumer Extended Security Updates (ESU) program until October 12, 2027. “Windows 10 support has ended. You can enroll in ESU any time […]

Microsoft gives Windows 10 users an unexpected extra year of free security updates Read More »

Record Microsoft Patch Tuesday, fresh zero-day

AI, Don't miss, Fortra, Hot stuff, Microsoft, Microsoft Defender, News, Patch Tuesday, patching, security update, Tenable, Trend Micro, Windows /

Record Microsoft Patch Tuesday, fresh zero-day 2026-06-10 at 14:23 By Zeljka Zorz Microsoft marked its largest-ever Patch Tuesday this month, by shipping fixes for nearly 200 vulnerabilities. Within hours, “Nightmare Eclipse”, the researcher behind weeks of escalating Windows exploit releases, dropped a proof-of-concept exploit for a new zero-day: “RoguePlanet”, which abuses a race condition in […]

Record Microsoft Patch Tuesday, fresh zero-day Read More »

Google patches Chrome zero-day exploited in the wild (CVE-2026-11645)

0-day, Chrome, Google, News, security update /

Google patches Chrome zero-day exploited in the wild (CVE-2026-11645) 2026-06-09 at 15:21 By Sinisa Markovic Google has fixed 74 vulnerabilities in Chrome, including a high-severity zero-day (CVE-2026-11645) that has been exploited in the wild. “Google is aware that an exploit for CVE-2026-11645 exists in the wild,” the company said in a Monday security advisory. The […]

Google patches Chrome zero-day exploited in the wild (CVE-2026-11645) Read More »

Scroll to Top