Security Saturday — the vulnerabilities, advisories, and incidents from the past week worth knowing about.
Security
- New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code (The Hacker News)
Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it. An anonymous HTTP - Friday Squid Blogging: Squid Washing Up on Cape Cod Beach (Schneier on Security)
Lots of articles about this . As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy. - OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests (The Hacker News)
Eleven bytes will make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On the glibc systems Okta tested, that memory is gone until the process restarts. OpenSSL shipped the HollowByte fix in Ju - Details of Alan Turing’s Voice Encryption System (Schneier on Security)
Really interesting piece of cryptographic history : In November 2023, a large cache of his wartime papers—nicknamed the “Bayley papers”—was auctioned in London for almost half a million U.S. dollars. The previously unknown cache contains ma - Microsoft Patches a Record 570 Security Flaws (KrebsOnSecurity)
Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesd
Enjoying these roundups?
Subscribe for daily follow-ups on AI news, trending open-source tools, and Security Saturdays.
Subscribe free →