TL;DR Storybook has patched CVE-2026-114125, a CVSS 9.4 Storybook dev server vulnerability that lets a malicious website change files in a developer’s project. Under further conditions, the …

TL;DR Microsoft has released an out-of-band .NET security update for .NET 8, 9 and 10, plus .NET 11 Release Candidate 3. It fixes CVE-2026-111497, a Brotli decompression buffer overflow, and CVE-2…

TL;DR The Apache Camel project disclosed eight Apache Camel vulnerabilities across components such as camel-saxon, camel-aws2-s3 and camel-keycloak. The most severe, CVE-2026-90885, is a high-seve…

TL;DR On October 23, 2026, the Ruby team shipped a Ruby security update in versions 4.0.9, 3.4.12 and 3.3.13. The releases fix memory bugs in Onigmo, Ruby’s regular expression engine. GitLab…

Imagine discovering that a lock used by millions of buildings has a hidden weakness. The lock has existed for years, thousands of people…

The developers of the popular open-source Bitcoin client Electrum have issued an urgent advisory. Specifically, maintainers urge all cryptocurrency users to upgrade immediately to version 4.8.3. A…

By Tejas Saubhage · Oct 26, 2026

A critical flaw within Google’s Brotli compression algorithm has sent shockwaves through the software industry. Specifically, the Brotli CVE-2026-111497 vulnerability permits unauthenticated…

1. Vulnerability Description

An analysis of the PHP2Shell incident, its potential security implications, and the lessons organisations can learn about vulnerability…

An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution.

TL;DR A full write-up and exploit are now public for CVE-2026-23074, a Linux kernel privilege escalation flaw in the teql traffic-control scheduler. The use-after-free dates back to Linux 2.6.12, …

What could a feature that fetches information possibly have in common with one that saves files?

PHP2Shell isn’t a WordPress bug or a Drupal bug — it’s in PHP itself, and a “Hello World” app running on an affected version is vulnerable…

Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.

SQL injection UNION attack, determining the number of columns returned by the query

Forescout found 12,976 exposed refrigeration services in 99 countries, warning that attackers could alter temperatures and spoil food, medicines and supplies.

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.

Cybersecurity investigators recently uncovered a sophisticated multi-stage intrusion against government-affiliated infrastructure. Specifically, adversaries compromised a public management portal …