Do Son Discover the details of recent MongoDB security vulnerabilities affecting drivers and BI connectors. Update your systems to patch CVE-2026-81525 and others.
security
PHP releases urgent security patches for a 9.5 severity RCE in the SOAP extension and a PHP-FPM XSS flaw. Update to 8.2.31, 8.3.31, 8.4.21, or 8.5.6 now!
Vim patches a critical 8.2 CVSS RCE (CVE-2026-34982). Malicious "modelines" can bypass sandboxes to execute commands. Update to 9.2.0276 immediately!
Perl (CVE-2026-4176) faces a 9.8 CVSS flaw due to a vulnerable zlib module. Affecting versions since 5.9.4, it demands an urgent update. Learn how to patch.
Scriban’s 9.1 CVSS flaw allows sandbox escapes in .NET apps via a cache bypass. Over 40M downloads affected. Update to version 7.0.0 to secure your templates.
QNAP patches high-severity flaws (CVSS 8.1) in Qfiling and MARS that allow data theft and code injection. Secure your NAS by updating to the latest versions!
A developer's Mac home directory was wiped after Claude AI executed an unconstrained rm -rf ~/ command. Experts urge using Docker to contain AI coding tools for safety.
A malicious Go package typosquat (bpoorman/uuid) operated for four years, using a hidden Valid function to silently encrypt and exfiltrate sensitive data to dpaste.com.
Telegram is developing passkey authentication to replace unreliable SMS codes. The move promises a far more secure login, leveraging biometrics (Face ID/fingerprint).
Following Apple's push, Let's Encrypt will cap all certificate validity at 45 days by 2028. Users must ensure automation is compatible with the significantly shorter lifetime.
Following major crashes, Microsoft will phase out OEM kernel-level driver privileges, forcing a shift to native drivers or user mode to prevent system-wide operating system failures.
Google will soon require all sideloaded Android apps to pass verification and code signing to combat fraud. However, the company is developing an "advanced process" for power users to bypass this.
Edge v142.0 introduces cross-platform passkey sync, letting users reuse passkeys securely across devices with a PIN, enhancing passwordless authentication.
IBM and Anthropic partnered to embed Claude AI into a new IDE for enterprise software development, with early internal testing reporting an average 45% developer productivity boost.
Two WordPress Core vulnerabilities (XSS and Info Exposure) affecting versions up to 6.8.2 were accidentally exposed before patches were ready.
A critical, unpatched OnePlus flaw (CVE-2025-10184) allows any app to read SMS data without permission, breaking MFA protections. PoC is available.
Apple's new iOS 26 update allows users to securely store their full credit card details in the Wallet app, enabling a safer way to autofill payment info.
Samsung has released an emergency patch for a critical zero-day vulnerability (CVE-2025-21043) actively exploited in Android devices. Update now to protect against RCE attacks.
Researchers expose BaoLoader, a malware operation that has systematically used at least 26 code-signing certificates over seven years to appear legitimate and bypass security.
A critical flaw in LangChainGo, a popular LLM framework, allows attackers to read sensitive files via server-side template injection. A patch has been released.
A new report reveals a major surge in phishing attacks targeting U.S. energy companies like Chevron, using cloned websites to steal credentials and financial data.
New patches for CUPS, the open-source Linux printing system, fix two flaws that can lead to remote DoS and authentication bypass.