Plex servers are being exploited. Updating and recovering are different jobs
Check the server build, not just the TV app. Confirmed exploitation makes the old installation’s integrity part of the res...
Ideas. People. A brighter tomorrow.
Security
36 stories
PHP’s critical security release is due today. Prepare the deployment now
Two critical flaws have prompted an advance patch notice. The release is scheduled for 14:00 UTC; the official affected-ve...
The emSign cleanup reaches Python: updating your browser is not enough
Python developers need to check pip, uv, certifi and container images because different tools carry different certificate...
Firefox 158.0.1 carries an emergency certificate block to harder-to-reach installations
Mozilla’s remote protection arrived on 17 October. Today’s browser update covers configurations that may have missed it.
Microsoft’s agent-security pitch comes down to who is allowed to act
Project Perception targets agents inside the organization. Separate identities and enforced permissions matter more than a...
Privacy Badger reaches Safari on Mac. Here is what another blocker adds
EFF’s extension requires Safari 26.5 or later and can stop tracking widgets before they load. Browser settings and extensi...
Windows changes its signing certificate. Hard-coded trust checks are the risk
Production PCA 2011 expires on 19 October. Microsoft’s guidance targets software that assumes one certificate identity wil...
Android verification is live in four countries. Here is its actual scope
The initial protections apply to participating stores on certified devices. Italy is outside that first group, and the adv...
The DNS root has a new signing key. The transition is not over
KSK-2024 is active after the October 11 switch. Operators still need to verify trust anchors, and retirement of the previo...