Originally published at zkLink Nova Exploit: A Stale Transient Hash Forged a Root No key was stolen and no signature was forged. The attacker wrote their own Merkle root into the bridge and then withdrew against proofs they had built…
CloudLinux + Imunify360 for VPS providers Node.js published security releases on October 21, 2026 that fix 10 vulnerabilities, with a highest severity of High. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that upstream says can allow remote code execution.
Some Android phones, mostly Samsung Galaxy models, now show a Google Play system update dated January 1, 2027. It isn’t a build from the future. It’s a routine update with the wrong date on it. The latest twist is a tipster’s report…
If you use SillyTavern from your phone or another PC, check three things now: the SillyTavern version, whether your Node.js has the 2026-10-21 security patch, and privateAddressWhitelist in config.yaml. The Node bug, CVE-2026-111497, went onto CISA's list of actively…
That ordering matters for incident review. A successful attack against this path looks like an authorised session from a known device, not like a brute-force attempt or a stolen password. Logs will show a legitimate tailnet peer opening a forwarded…
Session tickets let a client resume a TLS session without a full handshake. The server encrypts the session state with a ticket key and hands the result to the client; on resumption the client returns the ticket and the server…
Keystone has warned customers about phishing scams after unauthorized access to its website exposed shipping addresses, contact details and order records. The hardware-wallet maker confirmed the incident on October 24 and urged affected users to be cautious of messages from people…
A freelance designer frequently works from hotels and coworking spaces. The priority is to protect sessions on untrusted networks while retaining access to client portals, video meetings and file transfer. This is a reproducible test scenario and review framework, not…
Я Вадим, разработчик Unlimited VPN; это реклама. Если вы когда-нибудь поднимали OpenVPN или WireGuard на своём сервере, то, скорее всего, видели, как туннель, прекрасно работавший вчера, сегодня перестаёт соединяться. Причина обычно не в сервере и не в клиенте, а в…
Я Вадим, разработчик Unlimited VPN; в конце статьи — рассказ о нашем сервисе (это реклама). Классические VPN-протоколы хорошо шифруют трафик, но плохо прячут сам факт использования VPN. В сетях с DPI (глубокой инспекцией пакетов) это становится главной проблемой: соединение не расшифровывают,…
CVEs, exploits, SBOMs, and patch prioritization and virtual patching guides.
An article joins this feed when it matches these terms. Each one is also a search of its own.