Editorial Team

On October 21, two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed, affecting nearly 70% of websites worldwide. But if you think this’s only an admins’ headache, read on: we explain why your photos, music, archives, games, NAS and smart-home systems may be at risk, and how to protect your data and devices.

PHP developers have released patches for two critical vulnerabilities that could allow an attacker to remotely execute arbitrary code on the server without authentication.

Microsoft’s October Patch Tuesday bulletin is breaking records again — it addresses 1,414 vulnerabilities. Here’s what you need to know.

In April, our experts investigated the PAYLOAD campaign — where the leverage wasn’t data encryption but a malicious AD group policy object.

CVE-2026-87902, a new critical vulnerability in the WordPress core, is already being actively exploited in real-world attacks.

Any game based on the popular Unity engine made in the last eight years can allow attackers to get into your computer or smartphone. Here’s what to do about it.

A new large-scale attack on a popular JavaScript code registry has hit around 150 packages. The automatic propagation of the threat makes it especially dangerous — developers need to react ASAP.

Unknown attackers have compromised several popular npm packages in a supply-chain attack.

A popular developer tool has been trojanized and is uploading secrets to public GitHub repositories. We discuss what’s important to know for both developers and cybersecurity services.

Two critical zero-day vulnerabilities in SharePoint are actively exploited by attackers in real-world attacks.

Researchers have found a vulnerability that allows attackers to get root privileges on most Linux distributions.

Internet Explorer sends its regards: a vulnerability in the HTTP protocol extension allows attackers to run malicious code — even on a modern operating system.

Researchers have found a way to exploit a security mechanism in a popular machine-learning framework.

Microsoft’s March Patch Tuesday fixes several vulnerabilities that have already been used in the wild. Details are not clear at the moment, but it’s worth installing the patches ASAP.

Researchers have discovered a vulnerability in the 7-Zip file archiver software.

A vulnerability that permits bypassing authentication has been found in a popular security hardening plugin for WordPress.

Exploitation of vulnerability CVE-2024-43451 allows an attacker to steal an NTLMv2 hash with minimal interaction from the victim.

A backdoor implanted into XZ Utils has found its way into popular Linux distributions.

A vulnerability in the glibc library affects most major Linux distributions.

It means that some companies still have not installed MS Office patches that were published 5 years ago.

July Microsoft Patch Tuesday: a collection of exploited vulnerabilities.