Security & privacy By Ren
Know what changed. Know what matters.
Understand the security and privacy stories behind the headlines, without jargon or fear-driven noise.
The latest
Computer Security Likely to Deteriorate with Rising Vulnerabilities
New data shows a 25% increase in known software bugs this year, indicating smaller actors can now target critical systems more readily.
Read the storyExplore the coverage
Find a story by topic or search the full archive.
Computer Security Likely to Deteriorate with Rising Vulnerabilities
New data shows a 25% increase in known software bugs this year, indicating smaller actors can now target critical systems more readily.
Read storyBrotli Decoder Flaw Threatens Node.js and Cloud Systems
A memory‑corruption flaw in Google’s Brotli decoder threatens many widely used packages—including Node.js, Bun, Python Brotli, brotlicffi, and Envoy—potentially allowing remote code execution when attackers supply crafted compressed data.
Read storyBlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems
New firmware rootkit “BlackX” bypasses Secure Boot on patched Windows systems, targeting Central Asian diplomatic organizations linked to APT41.
Read storyPHP Warns of Unpatched RCE After Emergency Fixes
A new remote code execution vulnerability could let attackers run arbitrary code on misconfigured PHP applications.
Read storyArista Alerts on Critical VeloCloud SQL Injection Zero-Day
Arista issued an advisory on Oct. 22 about a zero‑day SQL injection flaw in its VeloCloud Orchestrator that lets logged‑in users gain operator privileges.
Read storyLiteLLM Malicious Package Release Triggers Supply‑Chain Alert
A compromised release pipeline pushed a credential‑stealer onto PyPI and Docker Hub.
Read storyGitLab RCE Vulnerability Fixed in October Update
A critical flaw allowing unauthenticated remote code execution across 12 years of releases was patched by GitLab on Oct 21.
Read storyPHP2Shell Vulnerabilities Fixed on Oct 21
Two critical PHP flaws called PHP2Shell will be patched at 14:00 UTC on Oct 21.
Read storyeMudhra Keys Compromised, Threatening Browser Trust
The private keys of eight eMudhra intermediate CAs were exposed on Oct 20, prompting Mozilla and Google to revoke them and warn that attackers can issue fraudulent TLS certificates for any site.
Read storyOVHcloud CLI Hijack Distributes Secret-Stealing Malware
Attackers replaced five OVHcloud command-line tool releases via a hijacked contributor's GitHub account, spreading malware that harvests secrets from any machine that runs it.
Read storyRank Math SEO Plugin Hijacked with Self‑Restoring Backdoor
A malicious update to the popular WordPress SEO plugin Rank Math PRO installed a self‑restoring backdoor on sites worldwide.
Read storyFake Web3 Accelerator Distributes Malware Through Malicious npm Packages
A fake Web3 accelerator has distributed information‑stealing malware and backdoors to Windows and macOS users through malicious npm packages.
Read story