Security, explained.

Threat awarenessEXPLAINER · 4 MIN READ

Qualcomm CVE-2026-21385: when memory-allocation arithmetic goes wrong

Qualcomm’s flaw concerns alignment calculations during memory allocation. The public record describes local access and targeted exploitation, while device-specific patch coverage depends on the manufacturer.

Identity & accessEXPLAINER · 3 MIN READ

Two curl bugs in Apple’s updates: redirects, proxies and credential mix-ups

The curl advisories describe a bearer token following the wrong destination and a proxy connection reused with the wrong identity. Each is a credential-state failure rather than memory corruption.

Identity & accessEXPLAINER · 3 MIN READ

macOS Accounts CVE-2026-43749: how path handling can lead to root

Apple fixed a directory-path parsing issue in the Accounts component. The advisory reports potential root privileges for an app, while leaving the precise path-handling failure unpublished.

Threat awarenessEXPLAINER · 3 MIN READ

WebKit CVE-2026-64728: an iframe sandbox flaw, explained

Apple repaired how WebKit enforces an embedded document’s permissions. The fix concerns iframe policy, which is different from a browser process escaping into the operating system.

Threat awarenessEXPLAINER · 4 MIN READ

Apple’s M5 MIE bypass: what the researchers demonstrated

Calif combined two macOS bugs to gain root on an M5 Mac while MIE remained enabled. Apple patched them in macOS 26.6. Here’s what the result says about memory tagging.

Defense & recoveryEXPLAINER · 3 MIN READ

GitLab CVE-2026-19478: protecting project data behind the GraphQL API

GitLab disclosed a critical flaw that could let an unauthenticated user alter or delete project and user data under certain conditions. Self-managed instances need update and recovery checks.

Defense & recoveryEXPLAINER · 3 MIN READ

Cisco IOS XR: why seven CVEs do not necessarily mean seven bugs

Cisco groups several IOS XR findings under seven CVE identifiers. That affects how you read the severity data—and why a base software version is not enough to confirm the fixes.

Threat awarenessEXPLAINER · 3 MIN READ

Adobe’s September Acrobat fixes: what happens when you open a PDF

The update addresses memory corruption and authorization flaws across Acrobat’s update tracks. Check the reader people use and the protections applied to outside documents.

Threat awarenessEXPLAINER · 3 MIN READ

Firefox’s September update: use-after-free bugs and sandbox escapes

Mozilla’s fixes cover Firefox 155 and two ESR branches. The advisories explain the risks, but checking the right update still starts with knowing which channel is installed.