Blog
Straight-talking security and compliance writing.
No vendor fluff and no unsourced statistics — every figure is checked against a primary source before we publish it. 15 articles across 6 topics.
Showing Vulnerability Intelligence articles — clear filter
PHP2Shell:
Two critical flaws in the parts of PHP every request touches, a leaked disclosure, exploitation attempts in the millions — and a third, narrower CVE that the fixed releases do not cover.
Vulnerability IntelligenceGitLab CVE-2026-110264:
A maximum-severity flaw in every GitLab release since 7.0, backported to seven release lines — and servers patched nine days earlier for a closely related bug are still exposed.
Vulnerability IntelligenceNode.js CVE-2026-111497:
Ten Node.js CVEs in one release, and the worst sits in a decompressor most teams have never called directly. The built-in fetch(), Express 5 and the popular HTTP clients call it for them.
Vulnerability IntelligenceThe eMudhra CA compromise:
Eight certificate-authority keys were generated with almost no randomness and sat in the open for eighteen months. Browsers blocked them within hours. Your servers, runtimes and appliances are a different story.
Stay ahead
Have a question this didn’t answer?
Every article here started as a question a client asked us. If yours isn’t covered yet, ask us directly — thirty minutes, no charge, no obligation.