Blog
Understand vulnerabilities. Without the noise.
Practical know-how for teams without a security department: what a vulnerability means for your stack, when you need to act and how to prove it.
Go to comparisons →What's on fire: critical vulnerabilities of the last 14 days →Subscribe to the blog via RSS
Blog
GitLab vulnerabilities CVE-2026-110264 and CVE-2026-97229: am I affected and what should I do?
Two critical RCE flaws in GitLab's regex compiler (CVSS 10.0): affected and fixed versions, why 19.4.2 is not enough, how to check your instance.
Read →
Blog
Brotli vulnerability CVE-2026-111497 (HTTP2Shell): am I affected and what should I do?
Critical bug in the Brotli decoder: affected and fixed versions for Node.js, Bun, Python, Envoy and libbrotli, how to check, interim measures.
Read →
Blog
PHP2Shell (CVE-2026-109618): am I affected and what should I do?
Critical RCE in the PHP core: affected and fixed versions, how to check your systems, pitfalls with Docker and distros, interim measures.
Read →
Blog
End of life 2026: PHP, Node.js and Python at a glance
Which PHP, Node.js and Python versions still get security updates. PHP 8.2 ends on 31 Dec 2026. With commands to check your repos.
Read →
Blog
CVSS, EPSS and CISA KEV: which vulnerability do you patch first?
Three scores, three questions: how bad, how likely, already exploited? How to prioritize vulnerabilities, using PHP2Shell as an example.
Read →
Blog
Vulnerability management under NIS2 and ISO 27001: what dev teams need to do
What NIS2 and ISO 27001 control A.8.8 require for vulnerabilities, translated into processes, deadlines and evidence for engineering teams.
Read →