Blog
Servers & hosting: security news
Critical vulnerabilities, actively exploited flaws, WordPress plugin issues, breaches and malware campaigns, explained for people who run websites: what happened, who is affected and what to do now. Every article lists its sources.
4 articles in Servers & hosting
Laravel CVE-2026-114509: TokenGuard Auth Bypass Fix
A critical flaw in Laravel's TokenGuard (CVE-2026-114509) can let an unauthenticated attacker sign in as another user on some MySQL/MariaDB setups. Upgrade to laravel/framework 12.68.0 or 13.29.0.
Pillow CVE-2026-112398: FPX Heap Overflow Leads to RCE
A critical heap buffer overflow in Pillow's FlashPix (FPX) JPEG decoder can lead to code execution when an application opens a crafted file. Versions up to 12.3.0 are affected; 13.0.0 is the patched release.
Actively exploited