News
-
OpenStack patches Manila flaws exposing cloud project boundaries
OpenStack has disclosed vulnerabilities in Manila shared file storage that could allow authenticated users to modify another cloud project’s public shares or access export metadata without proper authorisation.
-
Traefik fixes ForwardAuth flaw that could expose users to identity impersonation
Traefik has patched an authentication flaw that could allow an unauthenticated client to inherit another user’s identity when ForwardAuth relies on NTLM or Kerberos Negotiate connections.
-
French cyber authority identifies further Stormshield firewall and management vulnerabilities
France’s CERT-FR has issued another Stormshield security advisory, this time covering firewall and central management vulnerabilities associated with code execution, SQL injection, security bypass and service disruption.
-
eMudhra identifies weak certificate keys as browsers tighten trust protections
eMudhra says a flawed key generation process produced weak private keys for eight intermediate certificate authorities, prompting emergency browser protections and changes to certificate trust stores.
-
CERT-FR finds simple attack techniques behind nearly 200 web application data breaches
France’s national cyber incident response service followed nearly 200 web application data breaches in 2025, finding that many involved relatively simple attacker actions rather than exploitation of software vulnerabilities.
-
EU Council backs national reporting gateways in digital rules overhaul
The EU Council has agreed its position on simplifying data protection, privacy and cybersecurity reporting rules, proposing national incident reporting gateways instead of the Commission’s central EU model.
-
Sumsub adds data access and approval rules for MCP-connected AI agents
Sumsub has introduced a Know Your Agent module for controlling requests made through MCP connections. It says the service can filter sensitive data, log agent activity, and demand human verification for certain actions, initially with Amazon Bedrock AgentCore Gateway.
-
Cloudflare Zero Trust outage interrupts identity policy decisions
Cloudflare restored its Zero Trust connectivity after a 20 October fault affected Gateway traffic governed by identity conditions. Edge services recovered before its Access API; the company has not established a public root cause.
-
Go security releases restrict trust in selected certificate intermediates
Go has released versions 1.27.3 and 1.26.10, restricting certificate validation through selected intermediates. Maintainers cite security concerns but have not publicly named the authority, identified an affected organisation or established an exploitation event.
-
NCSC sets seven research priorities for AI in cyber defence
The UK NCSC has published seven research questions on AI in cyber security, covering autonomous defence, agent assurance, AI dependencies and national resilience. The new chapter is a research agenda, not a compliance standard.