Daily news, analysis and practical guides explaining what happened, who is affected and what to do next. We also turn this knowledge into practical training for organisations.
Threats and Incidents A new Integrity Tech advisory and the seizure of Microscan and FishHub infrastructure. Turn threat information into a review of mailbox and remote access.
AI Security CVE-2026-93034 affects SGLang deserialisation. Review exposure conditions, communication between nodes and the limits of the SGLANG_USE_PICKLE_IPC flag.
Governance and Compliance A SANS commentary from 10 October highlights the limits of TLP. Make better decisions about sharing reports, working with partners and using AI tools.
Threats and Incidents A valid token and an allowed IP address do not approve a payout. Lessons for fintechs, finance teams and the owners of payment integrations.
Cloud, Infrastructure and DevSecOps Pre-authentication SSRF requires an update to the remote-access appliance. Check the branch, hotfix number, change owner and employee communication.
Vulnerabilities and CVEs Review Veeam Backup & Replication 12 versions and access. Apply the fix, verify backup operations and prepare the team to respond to suspicious activity.
Cloud, Infrastructure and DevSecOps Match devices to their software branches, confirm fix availability and prepare a maintenance window. Track completed updates and releases still awaited.
Human Security Verify a new customer's quotation request before running an attachment. Establish a procedure for sales, procurement and IT, with a clear reporting route.
AI Security Check Splunk MCP Server 1.2.1, tool administrators and configured destinations. AI integration approval needs a clear assessment of credential handling.
AI Security Docling's SSRF issue affects untrusted documents with remote resource fetching enabled. Check version 2.132.0, parser configuration and network egress controls.
Vulnerabilities and CVEs A critical Langflow issue crosses the boundary between integration configuration and code execution. Check fixed packages, auto-login and process permissions.
Cloud, Infrastructure and DevSecOps The issue affects the RabbitMQ Java client's default JSON-RPC mapper. Check the parsing path, release 5.37.0 and permission to publish RPC messages.
AI Security The updated Cyber Verification Program separates defence, authorised testing and specialised access. Prepare data boundaries, permissions and oversight before rollout.
Human Security Mozilla has fixed a mitigation bypass in file handling. Check the Firefox update channel, the version actually running and devices awaiting a restart.
Vulnerabilities and CVEs CERT Polska has disclosed CVE-2026-75818, 75819 and 75820. Check Aspell usage, dictionary provenance and evidence of fixes in the packages actually deployed.
Once a month, a concise summary of the vulnerabilities and threats that matter. No spam, unsubscribe anytime.
