Netcrook
Today
When a Filesystem Cache Becomes a Privilege Trap
A newly tracked Linux FUSE flaw shows how a single size-check failure in kernel caching can create a path from ordinary local access to root-level risk.
Wireshark’s Latest Patch Exposes a Familiar Blind Spot: The Code That Reads the Data
Version 4.6.7 closes 12 security flaws in the packet analyzer’s decoders, file parsers, and external capture path, a reminder that inspection tools inherit their own attack surface.
When Inbox Content Turns Hostile: Zimbra’s Classic Web Client Gets a Critical XSS Patch
A browser-side flaw in a legacy mail interface shows how a single rendered message can become a session-level security problem for organizations that still rely on webmail.
XRING Turns Ordinary HTTP/3 Traffic Into a Server Crash Path
An unpatched flaw in Alibaba's XQUIC library shows how a standards-based protocol stack can still fall over when one internal variable goes wrong.
Python's Built-In HTML Parser Lands on the Availability Watchlist
A high-severity flaw in CPython's html.parser module shows how routine markup handling can become a denial-of-service risk when untrusted input meets core runtime code.
Four Siemens Flaws, Three High-Severity Warnings: Why OT Patch Days Are Never Routine
Siemens has issued security updates for four product vulnerabilities, a reminder that in industrial environments the real challenge is not just fixing bugs, but doing it without disrupting operations.
When the Seed Was the Weak Link: The Wallet Flaw Turning Old Backups Into Fresh Theft
A recovery-phrase generation flaw known as Ill Bloom shows how weak randomness at wallet creation can leave cryptocurrency funds vulnerable long after the original setup.
GNU Guix Faces a Rare Trust-Chain Break in Its Most Sensitive Paths
Multiple critical flaws in Guix’s substitute and channel-update workflows highlight how a package manager built for integrity can still be shaken by unsafe parsing, archive handling, and privileged daemon logic.
Session Theft at the Gateway: Why CitrixBleed 2 Turns MFA Into a False Sense of Safety
A cluster of incidents tied to Citrix NetScaler gateways shows how a stolen session can matter more than a stolen password, especially when the edge appliance itself is the weak point.
RoguePlanet Turns a Trusted Defender Into the Vulnerable Link
A patched flaw in Microsoft Defender’s malware engine shows why security tools need the same scrutiny as the threats they are built to stop.
Boot Trust at Risk: Six U-Boot FIT Flaws Put Early Firmware Security Under Pressure
Newly disclosed bugs in U-Boot’s FIT signature path could weaken the earliest trust checks in devices that rely on it, with consequences that range from code execution to boot-stage denial of service.
Roundcube’s Patch Day Exposes a Familiar Trap: Mail Content Can Attack Both the Browser and the Backend
Roundcube 1.7.2 closes high-impact XSS and SSRF issues, a reminder that webmail platforms sit where untrusted email content and server-side network access can become the same attack surface.
Six U-Boot Flaws Put the Boot Chain Under Pressure
Six critical vulnerabilities in U-Boot, reportedly reachable through malicious FIT images, may lead to pre-authentication code execution or early-boot denial of service.
Roundcube’s Patch Exposes the Quiet Dangers Hidden in Webmail Parsing
A security update for Roundcube 1.7.2 shows how browser-facing mail code can turn plain text, URL fetching, and legacy attachments into high-risk attack surfaces.
Microsoft Bets on AI to Narrow the Windows Vulnerability Window
The company is expanding AI-assisted security tooling across Windows, aiming to surface flaws sooner, speed remediation, and make patch delivery more dependable in a race where attackers are also moving faster.
GhostLock Turns a Quiet Kernel Path Into a Root-Access Trap
A long-lived Linux privilege-escalation bug highlights how one local foothold, one stale pointer, and one delayed patch can still matter across servers, containers, and CI systems.