semih.fun

Posts tagged “Security”

  1. 4 min read

    CVE-2024-27834: Apple Pointer Authentication Bypass Added to CISA KEV

    CVE-2024-27834 lets attackers bypass Apple's Pointer Authentication. CISA added it to its KEV list on Nov 4, 2026. Affected versions and update steps inside.

  2. 4 min read

    Brotli buffer overflow (CVE-2026-111497): which versions are affected?

    CVE-2026-111497 in Google Brotli is on CISA's exploited list. See which versions are affected, the fixed releases and how to check your systems.

  3. 4 min read

    Cisco ASA and FTD VPN denial-of-service flaw: CVE-2026-76418

    CVE-2026-76418 (CVSS 8.6) hits Cisco ASA and FTD SSL VPN and is on CISA's KEV list. Check if you are affected, and what to patch or mitigate now.

  4. 4 min read

    GitLab CVE-2026-97229: remote code execution through CI/CD configuration

    Critical CVE-2026-97229 in GitLab CE and EE, CVSS 10.0. Affected versions, fixed releases, the CISA deadline and what to do now.

  5. 5 min read

    Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: what to do now

    Root privilege escalation (CVE-2026-111357) and file upload (CVE-2026-118527) in Ivanti Connect Secure: affected versions, CISA deadlines and the fixes.

  6. 5 min read

    CVE-2026-46300 in the Linux kernel: skbuff flaw and update guide

    CVE-2026-46300 in the Linux kernel, now on CISA's exploited list. Fixed distro versions and the update steps you need to take.

  7. 4 min read

    Adobe Commerce and Magento file upload flaw: CVE-2026-48356

    CVE-2026-48356 lets dangerous file types be uploaded in Adobe Commerce and Magento. CISA lists it as actively exploited. Affected versions and fixes.

  8. 5 min read

    Remote code execution in Nextcloud's Collabora CODE server: CVE-2026-110447

    CVE-2026-110447 in Nextcloud's built-in Collabora CODE server is on CISA's KEV list. Fixed in richdocumentscode 26.4.303. No workaround. Here is what to do.

  9. 5 min read

    PHP memory corruption flaws: CVE-2026-109618 and CVE-2026-109619

    Two flaws in PHP 8.2 to 8.5 can lead to unauthenticated remote code execution. Here are the fixed versions and what to do now.

  10. 4 min read

    Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625): actively exploited

    Arista VeloCloud Orchestrator on-prem SQL injection (CVE-2026-114625, CVSS 9.4). On CISA's KEV list and actively exploited. Affected versions and next steps.

  11. 4 min read

    VMware ESX insufficient logging flaw: CVE-2026-41709

    VMware ESX insufficient logging flaw (CVE-2026-41709). CVSS 2.7 but listed in CISA KEV. Fixed builds and what to do now.

  12. 4 min read

    WordPress core CVE-2026-119977: code execution during core upgrades

    WordPress core CVE-2026-119977 (CVSS 8.1, on CISA KEV). Versions 4.7 to 7.1.3 are affected, 7.1.4 fixes it. What it is and what to do.

  13. 5 min read

    Coding with AI: what I hand over, and what I never do

    Notes from a developer who uses AI coding assistants every day. Which jobs to hand over, which not to, the traps, and a safe way of working.

  14. 6 min read

    The first 30 minutes on a new Linux server: a security checklist

    What to do in the first half hour on a fresh Ubuntu or Debian server. SSH keys, firewall, fail2ban, automatic updates, swap and a first backup.

  15. 6 min read

    PHP security checklist: the 8 holes I find most in real projects

    SQL injection, XSS, CSRF, password storage, sessions, file uploads and error settings: the most common holes in PHP projects, with code examples for each fix.