ProHoster > Blog

Category: Blog

Blog Section

Critical vulnerability in the Brotli decoder affecting Node.JS, Bun, browsers, HTTP clients, and other projects

Posted on

A vulnerability has been identified in the library with the reference implementation of the Brotli data compression format decoder (CVE-2026-111497, codenames Broccoli2Shell and HTTP2Shell), leading to a buffer overflow when processing specially crafted compressed data. According to Google, the vulnerability can be exploited for remote code execution when attacking projects that use the official Brotli decoder implementation. Among the projects affected by the vulnerability are: Node.js, Bun, Envoy, Istio, […]

Another vulnerability in PHP, allowing remote code execution in rare configurations.

Posted on

The PHP project developers have warned of the discovery of another vulnerability (CVE-2026-115560) that could potentially be exploited for remote code execution on servers under specific rare combinations of non-standard settings (not in default configuration) and executed PHP code. Details about the vulnerability will be published once the next set of PHP corrective releases is ready. As a workaround for protection, it is recommended to set the parameter in php.ini […]

Release of cryptographic libraries OpenSSL 4.1.0 and LibreSSL 4.4.0

Posted on

The release of OpenSSL library 4.1.0 has been announced, which implements TLS protocols and various encryption algorithms. OpenSSL 4.1 is categorized as a release with a standard support period, with updates released over 13 months. Support for the LTS branch of OpenSSL 3.5 will continue until April 2030. The project code is distributed under the Apache 2.0 license. Key innovations: Initial support for the Elbrus2000 (e2k) architecture has been added. […]

About 10% of the Tor exit nodes were involved in an attack to intercept SSH connections.

Posted on

Details of the incident have been published, during which attackers managed to gain control over 333 exit nodes in the Tor network (there are about 3000 exit nodes in total in Tor) and orchestrate the interception of unencrypted traffic and redirection of SSH connections. The attack began on October 2 (Friday evening) but was detected and started to be blocked on October 4. On October 5, all compromised servers were taken offline […]

Anthropic is developing techniques for the formal verification of existing software using AI.

Posted on

Anthropic has presented results from experiments on using AI models for formal verification of the reliability and security of existing projects. During the experiment, mathematical proofs of the absence of memory errors were generated using AI models for 123 open libraries tested in the OSS Fuzz infrastructure. The verification was conducted at the level of compiled assembly code for the RISC-V architecture. A total of […]

The first exploit bypassing address randomization has been announced for the PHP2Shell vulnerabilities.

Posted on

Researchers from VulnCheck have announced the discovery of the first exploit for the PHP2Shell vulnerability (CVE-2026-109618), which bypasses Address Space Layout Randomization (ASLR) on x86-64 systems with standard PHP configurations. The exploit allows attacks on systems running PHP versions 8.4.10-8.4.26 in default configuration. Previously, the difficulty in determining the memory layout in the mod_php module hindered the implementation of an exploit that could achieve code execution on real systems. For […]

Release of the KeePassXC password manager 2.8

Posted on

The release of the open-source cross-platform password manager KeePassXC 2.8.0 has been announced, providing tools for the secure storage of plain passwords, one-time passwords (TOTP), SSH keys, and other information deemed confidential by the user. Data can be stored in both a local encrypted vault and external cloud storage. The project's code is written in C++ using the Qt library and is distributed under GPLv2 licenses […]

The F-Stack 2.0 network stack has been released, operating in user space.

Posted on

The release of the F-Stack 2.0 project has taken place, which develops the FreeBSD network stack adaptation for isolated operation in user space in the form of a library. The project was created by Tencent, the largest telecommunications company in China, and is used in its products and services. The code is written in C and is distributed under the BSD license. It supports operation in Linux and FreeBSD. The project also supports translated […]

Malicious software has been injected into the PyPI package and Docker image with LiteLLM.

Posted on

The publication of a malicious release of the LiteLLM library has been recorded in the PyPI repository, which has 23 million downloads per week, alongside the injection of malicious code into the official Docker image of the project. This is not the first similar incident with LiteLLM — in March of this year, attackers had already published malicious releases after intercepting the maintainer's credentials. This time, the attackers released version LiteLLM 1.107.0, in […]

Issue-prone root certificates from eMudhra were generated in an HSM and underwent an independent audit.

Posted on

The company eMudhra released a statement regarding an incident in which eight root certificates of the certification authority had easily guessable private keys, possessing only 1 byte of entropy instead of 48. eMudhra claims that the certificates were generated in April 2025 during a public ceremony using HSM (Hardware Security Module) devices that have certification in compliance with FIPS 140-2 […]

Embargo violations and delays in patch development occurred during the resolution of vulnerabilities in PHP.

Posted on

PHP developers have published a report on issues that arose during the resolution of critical vulnerabilities in PHP that were fixed yesterday. Information about the vulnerability caused by memory exhaustion was obtained during an external audit back in 2024 but was perceived only as a theoretical possibility for an attack. The resolution has been delayed due to problems in reaching a consensus among PHP developers on how to […]

Release of the Dux Shell 2.0 user environment

Posted on

The release of the Dux Shell 2.0 user environment has been published, supporting operation over the composite servers niri, Hyprland, Sway, MangoWC, labwc, Scroll, Aqueous, and Miracle WM. This is the first release after the project was renamed from DankMaterialShell (DMS) to Dux Shell. The new name is simpler, reminiscent of the penguin Tux, and does not include part of another brand's name. Dux Shell continues to develop a set of intercompatible […]

« to the beginning 3 4 5 6 7 8 9 10 11 12 to the end »
Buy reliable website hosting with DDoS protection, VPS VDS servers 🔥 Buy reliable website hosting with DDoS protection, VPS VDS servers | ProHoster