Netcrook
10 Luglio 2026
Samsung Patches High-Severity Flaws as Android Fleets Face a Race Against Patch Delay
A fresh Samsung security release fixes multiple vulnerabilities, including five rated high, and the real security question is how quickly devices reach the corrected build.
Wireshark’s Latest Patch Shows Why Packet Parsers Are Prime Targets
Version 4.6.7 closes 12 security flaws, underscoring how a trusted network analyzer can become fragile when it ingests hostile traffic or capture files.
GNU Guix Bug Turned a Trusted Restore Path Into a Host-Write Risk
A vulnerability in Guix's privileged daemon shows how package restoration, when mishandled, can cross from software delivery into root-level file tampering.
The Quiet Kernel Bug That Could Turn a User Shell Into Root
A Linux FUSE flaw tracked as CVE-2026-31694 shows how filesystem trust boundaries can collapse into kernel memory corruption, with privilege escalation risk depending on version, layout, and patch status.
Plesk Alert Puts the Management Plane in the Crosshairs
A critical flaw in a web-based control panel is a reminder that authenticated access can still become a serious confidentiality risk when the management layer is weak.
The Gateway Trap: How a Citrix Session Bug Can Turn MFA Into a Paper Wall
A critical NetScaler flaw is being tied to active session hijacking, showing how an attacker may bypass the login ceremony without breaking the second factor itself.
When the Login Box Becomes the Blast Radius
Two critical Metabase flaws were patched after security updates, and the risk profile is unsettling: an authenticated user could turn ordinary access into arbitrary code execution on affected systems.
When a Filesystem Cache Becomes a Privilege Trap
A newly tracked Linux FUSE flaw shows how a single size-check failure in kernel caching can create a path from ordinary local access to root-level risk.
Wireshark’s Latest Patch Exposes a Familiar Blind Spot: The Code That Reads the Data
Version 4.6.7 closes 12 security flaws in the packet analyzer’s decoders, file parsers, and external capture path, a reminder that inspection tools inherit their own attack surface.
When Inbox Content Turns Hostile: Zimbra’s Classic Web Client Gets a Critical XSS Patch
A browser-side flaw in a legacy mail interface shows how a single rendered message can become a session-level security problem for organizations that still rely on webmail.
XRING Turns Ordinary HTTP/3 Traffic Into a Server Crash Path
An unpatched flaw in Alibaba's XQUIC library shows how a standards-based protocol stack can still fall over when one internal variable goes wrong.
Python's Built-In HTML Parser Lands on the Availability Watchlist
A high-severity flaw in CPython's html.parser module shows how routine markup handling can become a denial-of-service risk when untrusted input meets core runtime code.
Four Siemens Flaws, Three High-Severity Warnings: Why OT Patch Days Are Never Routine
Siemens has issued security updates for four product vulnerabilities, a reminder that in industrial environments the real challenge is not just fixing bugs, but doing it without disrupting operations.
When the Seed Was the Weak Link: The Wallet Flaw Turning Old Backups Into Fresh Theft
A recovery-phrase generation flaw known as Ill Bloom shows how weak randomness at wallet creation can leave cryptocurrency funds vulnerable long after the original setup.
GNU Guix Faces a Rare Trust-Chain Break in Its Most Sensitive Paths
Multiple critical flaws in Guix’s substitute and channel-update workflows highlight how a package manager built for integrity can still be shaken by unsafe parsing, archive handling, and privileged daemon logic.
Session Theft at the Gateway: Why CitrixBleed 2 Turns MFA Into a False Sense of Safety
A cluster of incidents tied to Citrix NetScaler gateways shows how a stolen session can matter more than a stolen password, especially when the edge appliance itself is the weak point.
RoguePlanet Turns a Trusted Defender Into the Vulnerable Link
A patched flaw in Microsoft Defender’s malware engine shows why security tools need the same scrutiny as the threats they are built to stop.
Boot Trust at Risk: Six U-Boot FIT Flaws Put Early Firmware Security Under Pressure
Newly disclosed bugs in U-Boot’s FIT signature path could weaken the earliest trust checks in devices that rely on it, with consequences that range from code execution to boot-stage denial of service.
Roundcube’s Patch Day Exposes a Familiar Trap: Mail Content Can Attack Both the Browser and the Backend
Roundcube 1.7.2 closes high-impact XSS and SSRF issues, a reminder that webmail platforms sit where untrusted email content and server-side network access can become the same attack surface.
Six U-Boot Flaws Put the Boot Chain Under Pressure
Six critical vulnerabilities in U-Boot, reportedly reachable through malicious FIT images, may lead to pre-authentication code execution or early-boot denial of service.