Apache has fixed a critical flaw in its HTTP/2 module that can lead to remote code execution. Who is affected, the fixed versions, the one-line workaround, what the sources say about exploitation, and why an AI scanner was credited first.
Browsing Tag
Software Vulnerabilities
21 posts
OpenSSH “SSHole” Bug: An Overlong Password Opens Some Linux Servers, and Attackers Already Use It
A flaw in OpenSSH lets attackers log in to some Linux accounts with an overlong password. It hits musl-based systems without PAM, such as Alpine. Who is affected, the fixed versions, what admins should check, how AI shaped the fast release, and what is still unknown.
Microsoft Fixes 1,094 Flaws This Patch Tuesday: One Is Under Attack, and Paint Needs Its Own Fix
Microsoft’s November 2026 Patch Tuesday lists 1,094 Microsoft CVEs, 17 times last November’s count. One Outlook flaw is already exploited, and a separate Paint fix had a messy rollout. Why the number is so high, what businesses should patch first, what home users should do, and what is still unknown.
N-able Pulls N-central Offline After 30+ “Zero-Days” Go Public. What to Ask Your IT Provider Today
N-able has taken its hosted N-central platform offline and told on-premises customers to switch their servers off after a researcher published more than 30 alleged flaws with attack code. Why one remote management server is a door into many networks, what N-able says, the questions to ask your IT provider today, and what is still unknown.
Chrome’s Eighth Zero-Day of 2026: Attackers Already Use an XML Bug. Here Is the Version You Need
Google has patched CVE-2026-125350, a use-after-free bug in Chrome’s XML component that attackers are already exploiting. It is the eighth Chrome zero-day of 2026. Which version you need on Windows, Mac, Linux and Android, how to check it, where Edge, Brave and Vivaldi stand, what companies should do, and what is still unknown.
France Says Iran’s Revolutionary Guards Hacked Its Supermarket Fridges. Here Is the Evidence It Showed
France says a cyber unit of Iran’s Revolutionary Guards switched supermarket fridges in about 700 stores to high temperatures in October, causing food losses and at least 15 fires. What France published as evidence, what Iran says, what is still unknown, and what connected cold-chain equipment means for businesses and shoppers.
Set to 110 °C: The Night Hackers Reached a Blood Bank’s Plasma Freezers — and Why the Alarm Won
During the night of 1 to 2 November 2026, someone reached a refrigeration contractor’s remote supervision system and raised the settings of plasma cold rooms at three sites of France’s blood service EFS, reportedly to 110 °C. It was a setpoint, not a temperature. An alarm and an on-call technician caught it, and no blood products were lost. What is confirmed, what the viral posts get wrong, the unverified claim of responsibility, a clearly labelled hybrid-threat scenario, and what businesses and consumers should do.
Freezers at 50 °C: The Second Wave of Attacks on Europe’s Supermarket Refrigeration
Three weeks after France, attackers switched supermarket freezers into defrost across at least six European countries in one night. What is confirmed, who is investigating, what we still don’t know, and the CERT-FR to-do list for companies.
Black October 2026, Episode One: Record CVEs, a $6 Billion Crypto Heist and AI on Both Sides of the Fight
October 2026 broke three security records: 17,060 new CVE records (4x October 2025), 36 new entries on CISA’s known-exploited list, and the largest crypto theft ever at Binance, which the FBI attributes to North Korea. AI showed up in the fixes, from Microsoft’s credits to PHP2Shell. My thesis, that the tools are out and a period of many hacks has begun, tested against the evidence, plus what companies and users should do now.
An AI Anyone Can Download Turned Firefox Fixes Into Working Attacks. What Epoch AI Showed, and What to Do Now
In Epoch AI’s lab test, the open-weight model GLM 5.3 turned published Firefox security fixes into working attacks on six releases, in as little as 12 hours and for about $1,000 per version, without a single refusal. What the patch gap is, what the study does and does not show, what Mozilla fixed in Firefox 159, and what companies and users should do now.