Open Source Security Blog
Two critical PHP security vulnerabilities, collectively known as the PHP2Shell vulnerability, have triggered emergency security updates and reports of exploitation attempts. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws affect the…
Vulert added 2,147 new vulnerabilities to its vulnerability intelligence during the week of 5 October to 12 October 2026. The latest report includes 289 Critical vulnerabilities, 271 High-severity findings, and…
Vulert added 1,857 new vulnerabilities to its vulnerability intelligence this week, covering the period from 28 September through 5 October 2026. The week’s data includes 387 Critical vulnerabilities, 159 High-severity…
VMware critical flaws patched by Broadcom affect VMware vCenter, ESX, Workstation, and Fusion, including two vCenter bugs rated CVSS 9.8 and a VMXNET3 issue that Broadcom characterizes as a virtual…
Rails CVE-2026-66066 is a critical Active Storage vulnerability that can allow unauthenticated attackers to read arbitrary files from Rails application servers through crafted image uploads when libvips is used for…
Two joyfill npm packages were compromised in beta releases to deliver import-time JavaScript malware associated with the DEV#POPPER remote access trojan family. The incident matters because the malicious code did…
The CISA KEV catalog should sit at the top of your vulnerability prioritization workflow because it answers the question CVSS cannot answer: is this CVE actually being exploited by attackers?…
The tanstack supply chain attack in May 2026 showed how quickly a trusted JavaScript package ecosystem can become a delivery path for credential-stealing malware when the attacker reaches the publish…
SaaS open source security becomes urgent the first time an enterprise prospect asks, “How do you monitor open source components for vulnerabilities?” A weak answer can pause the deal even…
A vulnerability management dashboard that lists 133 CVEs with CVSS scores is not a management dashboard. It is a raw export. A CTO needs the answer to 3 questions: are…