News


SecurityNewsExplainer
CVE-2026-98432: a Linux TCP use-after-free in IP options
A critical Linux kernel race in the TCP handshake, fixed in stable kernels: what the bug is, why 'only MPTCP' misleads, how to patch and mitigate.


SecurityNewsExplainer
PHP2Shell: when PHP's error exit leaves a mess behind
Two critical PHP RCEs patched on 21 Oct 2026: how longjmp() bailouts leave stale memory behind, how to check your version, and what is unconfirmed.


SecurityNews
One email can freeze your Node.js parser for seconds
A valid email header full of RFC 2047 encoded words froze postal-mime for seconds. How a harmless-looking check turned quadratic, and how to defend against it.