advisoryvia UK NCSC
Post-quantum updates to our TLS guidance
The NCSC publishes its recommendations for configuring post-quantum cryptography in TLS. Now is time to migrate.
Oct 15, 2026 UTC
Security news
Stories are collected automatically from public feeds, attributed to their original publishers and linked. Editors can remove anything. Always read the original source.
advisoryvia UK NCSC
Using TLS to protect data
Recommended profiles to securely configure TLS for the most common versions and scenarios, with additional guidance for managing older versions.
Oct 15, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic
Overview Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 conce...
Oct 14, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#948176: Multiple TLS libraries can bypass delegation enforcement
Overview This note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a...
Oct 14, 2026 UTC
policyvia Krebs on Security
U.K. Sanctions Cryptomus for RU Money Laundering
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomw...
Oct 14, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#166125: Bisheng has authentication bypass vulnerabilities
Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (I...
Oct 14, 2026 UTC
vulnerabilityvia Krebs on Security
Microsoft Patches More Than 1,400 Security Flaws
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's reco...
Oct 13, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#456950: Komodo Periphery Agent Contains an OS Command Injection Vulnerability
Overview Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names,...
Oct 13, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access priv...
Oct 13, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation
Overview This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those diffe...
Oct 13, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE
Overview Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote...
Oct 13, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1
Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Succes...
Oct 12, 2026 UTC