security advisory

The Linux kernel recently received a targeted security patch that fixes an input‑validation bug in the Ceph client library (libceph) which could allow out‑of‑bounds writes while handling authentication session keys — tracked as CVE‑2025‑68284 — and operators should treat the fix as actionable...

CVE-2025-1744 is a critical out‑of‑bounds write in radare2 that allows heap-based buffer over‑read or overflow in radareorg’s reverse‑engineering toolchain; the flaw affects radare2 releases prior to 5.9.9 and carries a top‑tier severity rating. Microsoft’s public advisory for this CVE...

Microsoft is rolling its in-house security expertise into a single, subscription-based package called the Microsoft Defender Experts Suite — a bundled, expert‑led offering that combines managed extended detection and response (MXDR), on‑demand and proactive incident response, and designated...

A newly disclosed vulnerability in the widely used Ruby URI library — tracked as CVE-2025-61594 — reopens a previously patched avenue for credential leakage by bypassing the fix for CVE-2025-27221 and allowing sensitive userinfo (username/password) to leak when URIs are combined using the +...

Neowin published an end-of-year roundup listing its "Top 10 most viewed stories" for 2025, but the original article is currently behind a site verification/paywall that prevents direct retrieval; the roundup’s existence and Neowin’s annual tradition are verifiable, yet the precise ordered list...

Microsoft’s brief advisory is accurate but narrowly scoped: Microsoft has attested that Azure Linux includes the upstream mtk-sd open‑source component and is therefore potentially affected by CVE‑2025‑38401, but that attestation is product‑scoped — not a guarantee that no other Microsoft product...

A newly disclosed, high‑severity vulnerability in the widely used Net‑SNMP suite can cause the snmptrapd daemon to overflow a stack buffer and crash — and operators must treat CVE‑2025‑68615 as an immediate remediation priority for any host running vulnerable Net‑SNMP versions. Background /...

The Linux kernel’s tracing subsystem received a targeted security fix for a subtle but real use‑after‑free risk: the trace event verifier previously skipped certain complex pointer formats such as "%*p..", allowing tracepoints to reference memory that might be freed before a trace reader...

A critical, low‑level kernel fix landed in mid‑2025 that patches a subtle race in the Linux DRM v3d driver: before resetting the GPU the driver must disable interrupts and ensure any in‑flight interrupt handlers have completed. The vulnerability, cataloged as CVE‑2025‑38371, describes a scenario...

The Linux kernel vulnerability tracked as CVE‑2025‑39863 is a focused but real use‑after‑free in the Broadcom/Cypress FullMAC Wi‑Fi driver (brcmfmac) that can be triggered by a race between a timer handler and the driver detach path; Microsoft’s public advisory names Azure Linux as the Microsoft...

A newly disclosed vulnerability, tracked as CVE-2025-49178, allows malformed X11 protocol requests to disrupt X server request processing — a flaw that can be weaponized to produce a complete denial of service against affected X server implementations (notably xorg-x11-server, Xwayland and...

Microsoft’s security index added a new entry today: CVE-2025-64669, an Elevation of Privilege (EoP) vulnerability affecting Windows Admin Center that Microsoft classifies as improper access control and assigns a CVSS v3.1 base score of 7.8 (High). Background / Overview Windows Admin Center (WAC)...

A subtle integer overflow in Apache HTTP Server’s ACME integration (mod_md) can turn a sensible certificate renewal backoff into an incessant retry loop after an extended series of failures, creating sustained renewal storms and operational headaches for administrators — the issue is tracked as...

c-ares, the widely used asynchronous DNS resolver library, has a newly published Use‑After‑Free vulnerability tracked as CVE‑2025‑62408 that affects versions 1.32.3 through 1.34.5 and has been fixed in 1.34.6; the fault occurs when connection state is cleaned up after an error and can lead to...

Microsoft’s CVE-2025-62559 advisory labels the issue as a Remote Code Execution (RCE) vulnerability in Microsoft Word, yet the published CVSS vector shows Attack Vector = Local (AV:L) — an apparent contradiction that has caused confusion among IT teams and security practitioners. The reality is...

A small but consequential memory‑management bug in the Linux kernel’s CIFS/SMB client — tracked as CVE‑2025‑40268 — has been fixed upstream; the vulnerability is a memory leak in smb3_fs_context_parse_param that can cause unreferenced kernel memory to accumulate when userland calls fsconfig...

The Linux kernel has a newly published security advisory — CVE-2025-40273 — describing a flaw in the NFS server (nfsd) state-management code: a copynotify stateid can remain referenced when its parent open state is freed, leading to list corruption and a kernel OOPS when laundromat later...

A small, surgical change to the Linux iwlwifi driver — preserving an error code during DVM-mode startup — closed a subtle but consequential bug tracked as CVE-2025-38656 that could lead to a kernel-level use‑after‑free and denial‑of‑service when debugfs is exercised; operators should treat the...

A small but consequential Linux kernel networking bug — tracked as CVE‑2024‑56647 — was disclosed and fixed in late December 2024; it can cause the kernel to hit an ip_rt_bug during certain ICMP error handling paths when IPsec (XFRM) is enabled, producing kernel warnings or OOPSes and risking...

The Rust shlex crate has a security blind spot: versions prior to 1.2.1 allowed the characters { and the non‑breaking space (0xA0) to appear unquoted in quoted arguments, which can turn a single intended argument into multiple tokens when that output is passed to a shell — a condition that can...