Articles and practical guidance tagged security.
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. It can expose services and clients that decompress attacker-controlled HTTP data to crashes, memory disclosure, or potentially code execution. Node.js, Bun, Envoy, Istio, and .NET have issued fixes, with exposure depending on how each application uses Brotli.
Read article
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can let unauthenticated requests reach remote code execution on vulnerable servers. The PHP project released fixes for PHP 8.2–8.5 on October 21. Here is what each bug does, which deployments need attention, and what to do now.
Read article
PwnEscape (CVE-2026-99999) is a Linux kernel networking flaw that lets a malicious virtual-machine guest target its host. Researchers confirmed host-memory disclosure in production sandboxes and demonstrated host crashes and host-root execution in controlled environments. Here is what the reports establish and what host operators should do.
Read article
Copy Fail (CVE-2026-31431) is a newly disclosed Linux local privilege escalation bug with a public proof of concept, broad distro impact, and serious consequences for shared servers, CI runners, and container hosts. Here is what is confirmed so far, how to check exposure, and how to remediate.
Read article
Late March 2026 brought a dense run of package compromises across CI tooling, PyPI, and npm. Here is what happened, why it matters, and what engineering teams can do right now to reduce exposure.
Read article