News that matters, without the noise.

CVE-2026-47874

Medium Severity Description The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing

Apache Tomcat Vulnerabilities Let Attackers Bypass Security Controls and Crash Servers

The Apache Software Foundation has patched a dozen security vulnerabilities in Apache Tomcat, the widely deployed open-source Java

CISA Warns of Gitea Code Injection Vulnerability Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency has added a newly disclosed Gitea vulnerability to its Known Exploited Vulnerabilities

RHSA-2026:60427: Important: iscsi-initiator-utils security update

An update for iscsi-initiator-utils is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions.

USN-8683-1: libheif vulnerabilities

Feng Ning discovered that libheif incorrectly handled certain image transforms. A remote attacker could possibly use this issue

Vulnerability in OpenSSL library

CVSSv3 Score: 7.5 A security advisory was released affecting the version of OpenSSL library used in some Fortinet

CCDL1: Cloud Security & AI Modules

USN-8682-1: Bind vulnerabilities

Vitaly Simonovich discovered that Bind could exhaust memory during GSS-API TKEY negotiation. A remote attacker could possibly use

Dark Caracal Adds New Malware to Cyber Espionage Arsenal

GoCaracal is a new modular malware framework that broadens Dark Caracal’s capabilities to steal data and maintain access

Critical Avada WordPress theme flaw enables zero-click RCE

A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker

Exclusive: NSA to host a hacker reunion in bid to rebuild secretive unit

The National Security Agency will welcome back to campus potentially hundreds of former members of the elite group

Red Flags That Expose Fake North Korean IT Workers

North Korean operatives posing as IT workers are improving their tactics, but researchers say there are still ways