Security Feed
Curated advisories, threat briefs & field intel — attributed, dated & severity-tagged. Kept deliberately separate from my own writing.
1. Executive summary Cloudflare has opened a HackerOne bug-bounty capture-the-flag challenge built around php2shell, the pair of PHP runtime flaws tracked
1. Executive summary BSI's Warn- und Informationsdienst published WID-SEC-2026-4170 on 2026-10-27, rating a code-execution flaw in
1. Executive summary StepSecurity has released inventory tooling for AI coding agent plugins, covering both plugins installed on developer machines (Claude Code and Codex)
1. Executive summary DreamHost suspended its File Manager service at files.dreamhost.com and reset passwords for an unspecified number of email and FTP/
1. Executive summary Citrix patched eight vulnerabilities in NetScaler ADC and NetScaler Gateway on 27 September 2026, two of which, CVE-2026-88771 and
1. Executive summary Ransomware.live published an entry on 27 October 2026 naming Italian manufacturer TECNA ICE and associating the claim with Everest. The
1. Executive summary The NCSC reports that FCA guidance now clarifies when publicly listed organisations may share cyber incident information with the NCSC, government
1. Executive summary On 27 October 2026, Ransomware.live indexed a listing that names Italian furniture manufacturer Natuzzi as a victim and Everest as
1. Executive summary CERT-UA reported unauthorised remote access to Dahua IP cameras and digital video recorders in Ukraine. Recorded activity included access to
1. Executive summary CVE-2026-80097 is an improper authentication flaw in Microsoft Authenticator for Android versions before 6.2606.4246. A rogue Android
1. Executive summary Dragonforce has listed Ukrainian logistics technology provider Zhito Technology on its leak site, according to Ransomware.live. The listing does not
1. Executive summary Ransomware.live recorded a BYOD claim that 36,000 University of New Mexico systems, two Active Directory forests, the university’s