Security advisories & news
Urgent advisories and fix guides written by the TCSR team, plus an automated weekly roundup of the most important IT-security stories.
TCSR Weekly Roundup: Ivanti Zero-Days, a Record Crypto Heist, and Supply-Chain Woes
This week: Ivanti patches more exploited zero-days, the FBI ties a record Binance theft to North Korea, and multiple vendor breaches hit supply chains.
TCSR Cyber Security Weekly Roundup: AI Sandbox Escapes, Brotli Flaws, and EOL Deadlines
This week: AI agent sandbox escapes, Brotli decoder flaws across runtimes, Windows Server 2016 EOL, and Quest Diagnostics breach updates.
Lock Your Origin: Cloudflare Doesn't Protect a Server Anyone Can Reach Directly
A CDN or WAF only filters traffic that passes through it. If your server answers on its own IP, an attacker can skip the edge entirely. How to check, how to lock nginx to the edge correctly, and the traps that break sites.
The eMudhra CA Compromise: Why Updating ca-certificates Isn't Enough
Chrome blocked the compromised eMudhra intermediates within hours. Your servers have more than one trust store — the OS bundle, the copies inside container images, and the list Node.js ships with. Where to look and what to change.
You Patched PHP. Did You Restart It?
Installing a fixed package replaces files on disk; running processes keep the old code. How PHP-FPM reloads behave, which long-running PHP processes get forgotten, and how to prove everything runs the new binary.
End-of-Life Is a Security Setting: When Your OS, PHP or Node Stops Getting Fixes
An end-of-life runtime does not fail loudly — it simply stops receiving fixes. What the October 2026 releases showed about old PHP, Node and Ubuntu, and how to retire runtimes without breaking what still uses them.
Patch Released Is Not Patch Installed: The Hidden Delay Between a PHP Fix and Your Server
Upstream ships source at a fixed hour; your packages follow on their own schedule — sometimes hours later. How to see where the fix actually is, and what to do in the gap.
Urgent: Two Critical PHP RCEs (CVE-2026-109618, CVE-2026-109619) — Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12
PHP shipped emergency fixes on 21 October 2026 for two unauthenticated remote code execution flaws rated CVSS v4.0 9.2. Upgrade, restart every PHP process, and use the interim mitigation only as a bridge.
TCSR Weekly Security Roundup: Supply Chain Attacks, Critical Edge Vulnerabilities, and AI Risks
Weekly news: ConnectWise supply-chain breach, API key exposures, critical Drupal and Magento patches, and shifting AI security demands.