- Home
- Security
Security fixes for the tools you run
Flaws in software you might be running yourself, from PHP and Node to the AI coding tools. Each page lists the versions that are hit and the ones that fix it, with commands to check yours and update. The facts come from the vendor's own advisory, GitHub's advisory database, NVD and CISA's list of flaws attackers are using right now.
4 advisories · 1 actively exploited
HighNewnpm package (body-parser)body-parser before 1.20.9 and 2.4.0: one compressed request can crash a Node.js appFixed in
2.4.01.20.9How to fix itCriticalNewPHPPHP 8.2 to 8.5: two remote code execution flaws, update nowFixed in8.2.358.3.368.4.278.5.12How to fix itHighActively exploitedNewPlex Media ServerPlex Media Server: four flaws attackers are already using, fixed in 1.43.3.10861Fixed in1.43.3.10861How to fix itCriticalNewPython package (pillow)Pillow before 13.0.0: one crafted image file can run code on your server, update nowFixed in13.0.0How to fix itSecurity news
All security stories- Oct 23
Anthropic says Claude proved 239 test entry points in 123 open-source libraries never crash
- Oct 23
Hacker jailbreaks Switch 2 through a Switch 1 BASIC game, and Codex found the first bug
- Oct 22
Microsoft says a China-aligned group used the ARTEX AI agent to breach ConnectWise and hundreds more
- Oct 21
Anthropic says Claude found 493 attack-surface issues in 25 open-source projects, including OpenSSH
- Oct 21
PHP patches two critical flaws, one found with OpenAI's GPT-5.6 Sol
- Oct 20
Meta pauses Muse chat sharing after a security firm finds 6,800 share addresses in public DNS
- Oct 19
OpenCode says a distillation attack exposed the AI provider keys of 1.4% of its Console users
- Oct 10
ARTEX's author takes the AI pentesting agent closed-source after CrowdStrike tied it to Korean bank breaches
- Oct 8
Anthropic offers Claude and on-site engineers to power grid defenders, plus free open-source bug scans
- Oct 8
CrowdStrike says an attacker likely used the ARTEX AI agent against South Korean banks
- Oct 6
Anthropic merges Glasswing into a three-tier cyber program that unlocks Opus 5.5 and Mythos 5.1
- Sep 28
Google says stolen AI accounts sell at up to 99% off, but prices more than doubled