Vulnerabilities
Detecting npm Package Vulnerabilities in Your Supply Chain
Most supply chain attacks bypass signature checks by exploiting legitimate dependencies, meaning you must monitor for behavioural anomalies rather than just known bad hashes.
Vulnerabilities
Vulnerabilities coverage from Phish Herald holds 43 articles, 26 of them reference guides. The newest was published on October 16, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include CVE Program and OWASP Top Ten.
Vulnerabilities
Patch Prioritization Logic: How to Rank Fixes by True Risk
Patch prioritisation separates urgent security fixes from routine updates by analysing exploitability and asset exposure, preventing system downtime caused by indiscriminate patching.
Vulnerabilities
Hardcoded Secrets Myths: Why Common Beliefs About Source Code Risks Are Wrong
Obfuscation does not secure secrets, and build-time injection fails when infrastructure pipelines lack strict isolation controls.
Vulnerabilities
Apache Struts Vulnerabilities: Real Questions Answered for Secure Infrastructure
Remote code execution flaws in Apache Struts often bypass perimeter defences because the framework processes malicious data before standard input validation occurs.
Vulnerabilities
VPN Appliance Vulnerabilities: 7 Mistakes That Leave You Exposed
Misconfigured split tunnelling and weak certificate validation often expose internal networks far more than the appliance software itself ever could.
Vulnerabilities
Remediation Tracking: Fixing the Six Common Misconceptions
Tracking vulnerability remediation fails when teams confuse administrative closure with actual risk reduction, leaving hidden exposures in production systems.
Vulnerabilities
iOS Zero-Click Vulnerabilities: Hidden Signs and Immediate Response Steps
Zero-click exploits bypass user interaction entirely, meaning the first sign is often anomalous system behaviour rather than a visible alert or notification.
Vulnerabilities
Detecting Cisco IOS XE Vulnerabilities: Signals, Tools and Blind Spots
Most IOS XE flaws manifest through subtle telemetry anomalies rather than obvious system crashes or immediate network outages, requiring persistent monitoring.
Vulnerabilities
IoT Device Patching: Definition, Purpose and Critical Mechanics
Firmware updates resolve low-level hardware flaws that application patches cannot touch, yet most teams ignore the supply chain risks inherent in binary blobs.
Vulnerabilities
Prevent GraphQL Vulnerabilities: Priority Controls for Your API
Default GraphQL servers expose your entire schema and allow deep nesting, turning every query into a potential denial-of-service vector before you write a single line of validation code.
Vulnerabilities
Clickjacking Prevention Checklist: Secure Web Interfaces
Standard browser protections now block most clickjacking attempts, but legacy interfaces and embedded frames remain vulnerable to user interface redress attacks.
Vulnerabilities
Threat Modeling Designing for Security: A Structural Approach
Threat modeling shifts security from reactive patching to proactive architecture, exposing flaws in logic and data flow before code is written or deployed.
Vulnerabilities
Web Application Firewalls: 6 Common Misunderstandings to Avoid
Web application firewalls filter traffic based on signatures, not intent, leaving logic flaws and authenticated attacks largely invisible to standard rule sets.
Vulnerabilities
Prevent WordPress Plugin Vulnerabilities: A Risk-Based Approach
Removing write access for plugins reduces attack surface more effectively than installing additional security layers or scanning tools.
Vulnerabilities
Prevent Open Redirect Vulnerabilities: A Technical Prevention Checklist
Open redirects bypass browser security checks by masquerading as trusted domains, allowing attackers to steal session tokens or facilitate phishing campaigns without hosting their own infrastructure.
Vulnerabilities
Organisations urged to audit npm trust configs after GitHub patches flaw risking 10M downloads
Abandoned GitHub repository names allowed attackers to hijack package publishing trust, risking millions of downloads.
Vulnerabilities
Organisations Face Critical CVE-2026-87744 Risk as Quarkus Panache Drops Role Checks for Unauthenticated Access
A critical vulnerability in Quarkus REST Data Panache allows attackers to bypass security controls by exploiting how the code generator handles method properties.
Vulnerabilities
Orgs Face Impersonation Risk: Privasys ra-tls-clients 0.11.0 Patches Critical CVE-2026-108362
A critical flaw in Privasys ra-tls-clients allowed impersonation of attested endpoints. Version 0.11.0 resolves the issue by enforcing strict platform identity checks.
Vulnerabilities
Organisations face critical risk as Thirty Bees 1.7.0 flaw lets attackers reset user passwords via guest tokens
Unauthenticated attackers can reset passwords for registered users in Thirty Bees 1.7.0 via guest checkout tokens, posing a critical risk.
Vulnerabilities
GitLab CE/EE RCE forces urgent upgrades for self-managed users after CERT-EU warning
CERT-EU warns self-managed GitLab users to upgrade immediately after a CVSS 10.0 flaw allows unauthenticated remote code execution.
Vulnerabilities
What Is Cache Poisoning: How It Works and How to Stop It
Web cache poisoning allows attackers to serve malicious content to thousands of users by tricking servers into storing and re-serving tampered responses.
Vulnerabilities
Difference Between Broken Access Control and IDOR Explained
Broken access control is a broad category of failure, while IDOR is a specific object-level flaw that often hides inside larger permission gaps.
Vulnerabilities
Single Request Can Freeze Next.js Servers via React Server Components Flaw
High-severity CVE-2026-23870 allows attackers to cause denial of service in React 19 deployments without authentication or user interaction.
Vulnerabilities
Organisations urged to review Wordfence data on WordPress flaws disclosed 28 Sep-4 Oct 2026 to secure platforms
Organisations should review the latest Wordfence Intelligence data on WordPress flaws disclosed between 28 September and 4 October 2026.