ALL POSTS

Key Findings Zimbra Collaboration Suite 10.1.20 patches a critical SNMP command injection vulnerability and multiple XSS bugs in the Classic Web Client The SNMP flaw allows arbitrary command execution on servers when SNMP notifications are enabled Four separate XSS vulnerabilities can be triggered through malicious attachment names and crafted input fields Additional patches address EWS access control issues, mailbox delegation flaws, SSRF in Nextcloud integration, and mail-f

Key Findings Chrome 149 addresses 28 security vulnerabilities across desktop platforms, with 5 critical flaws that could enable arbitrary code execution Critical use-after-free bugs dominate the patch set, affecting Core, DigitalCredentials, WebMIDI, and GPU components One critical flaw involves insufficient input validation in Accessibility features, while another is a heap buffer overflow in GPU 23 high-severity issues span Network, Media, Cast, Autofill, DevTools, and Exte

Key Findings Drupal Security Team releasing emergency core security update May 20, 5-9 p.m. UTC across all supported branches Vulnerability is severe enough that exploits could be developed within hours or days of patch release Update affects Drupal 11.3.x, 11.2.x, 10.6.x, and 10.5.x with best-effort patches for 11.1.x and 10.4.x End-of-life versions (Drupal 8 and 9) receiving manual patch files only, with no guarantees Drupal 7 is not affected by this vulnerability Backgroun

Key Findings Apache HTTP Server 2.4.66 contains CVE-2026-23918, a critical double-free vulnerability in HTTP/2 handling with a CVSS score of 8.8 The flaw enables both denial-of-service attacks and remote code execution under certain conditions Affected versions are patched in Apache 2.4.67 Exploitation requires minimal effort for DoS but RCE demands specific server configurations with APR mmap allocator MPM prefork mode is not affected, but HTTP/2's widespread deployment sign