Security & Advisories

Technical post-mortems of zero-day exploits, CVE disclosures, cryptographic flaws, and emergency runtime patches across Node.js, Bun, PHP, Java, UEFI, Veeam, and AI infrastructure.

Editorial cross-section illustration of a building above layered earth, with a thin wavy line entering a crack deep in the foundation

Mazzden in Security · Oct 28 · CVE-2026-97631 · 9.5

CVE-2026-97631: A 16-Year-Old EDK2 PXE Bug Puts Server Boot Firmware at Risk

A buffer overflow in the TianoCore EDK II network boot driver lets an attacker on the network run code before the OS and Secure Boot take over, and an early leak means the patch is already public.

UEFI 6 min read

Editorial ink-and-wash illustration of an archive vault with neatly stacked boxes and a small side door left ajar, warm light spilling through

Mazzden in Security · Oct 28 · CVE-2026-108142 · 9.1

Veeam Patches Critical Unauthenticated Bypass in Backup & Replication 13 (CVE-2026-108142)

October 27 bulletins also fix a critical cross-tenant SQL injection in Veeam Backup for Microsoft 365. Backup servers are a favorite ransomware target, so patch now.

Veeam 5 min read

Editorial illustration of three interlocking architectural courtyards with an open gate on warm paper

Mazzden in Security · Oct 27 · CVE-2026-112346 · 9.9

Critical CVEs Hit AI Agent and Cloud Infrastructure: OpenHands SDK RCE, Google MCP Toolbox File Exfiltration, and Consul-k8s ACL Bypass

Three critical advisories published on October 26, 2026 share one lesson: default-open settings in agent sandboxes, MCP servers, and service meshes are an attack surface.

CVE-2026-112346 6 min read

Editorial illustration of a chambered nautilus shell cross-section beside a brass magnifying glass on linen paper

Mazzden in Security · Oct 25 · CVE-2026-109618 · 9.2

PHP2Shell (CVE-2026-109618): Pre-Auth RCE Threatening 70% of the Web Discovered by GPT-5.6 Sol

How security researchers at Calif used OpenAI's GPT-5.6 Sol under the Patch the Planet initiative to uncover the most critical PHP remote code execution flaw of the year.

PHP 8 min read

Editorial illustration of a stone archway with a shifted terracotta keystone beside a ceramic vessel

Mazzden in Security · Oct 24 · CVE-2026-91403 · 9.1

Oracle Java SE & GraalVM Out-of-Band Alert: Critical JSSE TLS Flaw (CVE-2026-91403)

Oracle issues an urgent advisory for CVE-2026-91403 (CVSS 9.1) in the Java Secure Socket Extension, remotely exploitable over the network without authentication.

Java 5 min read

Editorial illustration of a folded paper accordion book beside a ceramic teacup on a wooden table

Mazzden in Security · Oct 23 · GHSA-cf8x-9m69-3gg3 · 9.2

Bun v1.4.4 Released: Fixing the 'Header Accordions' HTTP/3 QPACK DoS & eMudhra CA Revocation

Why upgrading to Bun 1.4.4 is essential to prevent HTTP/3 memory amplification, patch Brotli CVE-2026-111497, and rebuild standalone compiled binaries.

Bun 6 min read

Editorial illustration of a vintage wooden bookbinding press clamping stacked paper sheets with an uncoiling terracotta ribbon

Mazzden in Security · Oct 22 · CVE-2026-111497 · 9.8

Node.js October 2026 Security Emergency: Brotli RCE (CVE-2026-111497) & TLS Validation Bypass

A deep technical breakdown of the October 2026 Node.js security releases addressing a critical out-of-bounds write in the bundled Brotli decoder and NUL byte DNS truncation.

Node.js 7 min read