Vulnerabilities
Mitigations and Workarounds: Security Controls Without Patches
Temporary security controls often introduce hidden complexity and maintenance costs that persist long after the original vulnerability is resolved.
Vulnerabilities
Vulnerabilities coverage from Malware Brief holds 19 articles, 10 of them reference guides. The newest was published on October 9, 2026. New stories are added as soon as they are confirmed, from more than 50 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include FIRST: Common Vulnerability Scoring System and MITRE CWE.
Vulnerabilities
Backported Security Fixes: How They Work and Why They Matter
Backported fixes change only the vulnerable code paths, keeping the rest of the software unchanged to prevent breaking existing systems.
Vulnerabilities
How to Prevent Hard-Coded Credentials in Source Code
Hard-coded credentials persist in binaries and version history long after application logic changes, creating invisible attack surfaces that standard scanning often misses.
Vulnerabilities
How XML External Entity Attacks Work and Where They Fail
XXE exploits parsers that trust external data sources, allowing attackers to read local files or trigger server-side requests without executing code directly.
Vulnerabilities
Patch Management: Eight Questions Answered for Stability
Delaying updates to avoid downtime often increases risk, because unpatched systems accumulate multiple vulnerabilities that compound over time.
Vulnerabilities
Dependency Updates for Small Teams: Practical Maintenance
Updating third-party code reveals hidden technical debt and configuration flaws that standard vulnerability scanners miss entirely.
Vulnerabilities
Patching vs Virtual Patching: How to Choose the Right Fix
Virtual patching buys time by blocking exploits at the network edge, but it never removes the underlying code flaw that attackers eventually bypass.
Vulnerabilities
Secure Code Review: Nine Practices for Finding Hidden Flaws
Manual inspection catches logic errors that automated scanners miss, but only if you review the data flow rather than just the syntax.
Vulnerabilities
Software Composition Analysis Checklist for Secure Dependencies
Most application vulnerabilities originate in third-party libraries rather than your own source code, making dependency tracking the primary defence against supply chain attacks.
Vulnerabilities
Detect End-of-Life Software: Signals, Tools and Blind Spots
End-of-life software leaves distinct forensic traces in dependency chains and version mismatches, often hiding in plain sight within legacy infrastructure.
Vulnerabilities
Organisations Risk Remote Code Execution via Critical Command Injection in @enmaso/node-convert Library
A critical command injection flaw in @enmaso/node-convert allows remote execution of system commands through unsanitized inputs.
Vulnerabilities
Skyeye TTS Vulnerability Enables Unauth PowerShell Execution on Windows Servers
A critical unauthenticated command injection in Dromara Skyeye allows remote attackers to execute PowerShell code on Windows servers via a text-to-speech endpoint.
Vulnerabilities
Open-source maintainers receive automated AI vulnerability reports from Anthropic's new free scanner
The AI firm offers opt-in vulnerability scans for open-source code, delivering automated reports generated by its strongest models without human review.
Vulnerabilities
Critical Unauth SQLi in PHPNuxBill FreeRADIUS Puts Orgs at Risk, Enabling Credential Theft via Blind Injection
A critical flaw in PHPNuxBill’s FreeRADIUS module allows attackers to extract credentials via blind SQL injection without authentication.
Vulnerabilities
Organisations urged to patch IBM Guardium 12.1/12.2.2 to stop unauthenticated container hijack and cluster takeover
A critical vulnerability in IBM Guardium allows unauthenticated attackers to execute arbitrary container images and seize control of managed edge clusters.
Vulnerabilities
Organisations urged to patch IBM Guardium 12.0-12.2 after critical unauthenticated RCE flaw exposed
A critical path traversal flaw in IBM Guardium versions 12.0 to 12.2 allows remote attackers to execute arbitrary code without credentials.
Vulnerabilities
IBM access software flaw lets attackers run code without credentials, hitting versions up to 10.0.9.2 and 11.0.3
A deserialization flaw in IBM access management software lets attackers run arbitrary code without credentials, affecting versions up to 10.0.9.2 and 11.0.3.
Vulnerabilities
Service Outages Loom as CISA Orders Federal BIND TKEY Fixes by Oct 11
CISA added an old but active BIND vulnerability to its critical catalog, demanding federal action within three days to prevent service outages.
Vulnerabilities
Handlebars RCE flaw allows server compromise via prototype bypass
A critical vulnerability in the Handlebars templating engine enables remote code execution by bypassing security controls, affecting versions up to 4.7.9.