curl 8.21.0 Fixes 18 CVEs, Including 25-Year libcurl mTLS Bug
curl 8.21.0 patches 18 security flaws, including CVE-2026-8932 in libcurl mTLS connection reuse. Developers should inventory embedded libcurl copies and rebuild affected apps.
Author profile
Emma Davis
Content editor and security writer focused on making malware-removal and scam-prevention guides easier to understand. Emma reviews structure, clarity, and source consistency before articles are published.
1,078 articles
Editorial review
Reader clarity
Security guidance
Published work
Recent articles by Emma Davis
News · June 24, 2026
Lantronix EDS5000 CVE-2025-67038: Patch Root RCE Now
CISA says Lantronix EDS5000 CVE-2025-67038 is being actively exploited. Admins should update exposed EDS5000 serial device servers and review root-level compromise signals.
News · June 24, 2026
StealC and Amadey Takedown: 27M Credentials Recovered
Operation Endgame disrupted StealC and Amadey malware infrastructure, with officials reporting 326 servers neutralized and 27 million compromised data sets recovered.
News · June 23, 2026
UniFi OS CVE-2026-34910: Patch Root RCE Chain Now
CISA has added the UniFi OS CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 chain to KEV. Patch exposed UniFi OS consoles and rotate secrets after updating.
News · June 23, 2026
FFmpeg PixelSmash CVE-2026-8461: Patch Media Servers Now
FFmpeg PixelSmash CVE-2026-8461 affects MagicYUV decoding before 8.1.2. Patch media servers, desktop video tools, and thumbnail workflows that process untrusted files.
News · June 22, 2026
WhatsApp VBS Malware: Fake Documents Install Remote Access Tool
An active WhatsApp malware campaign is sending fake business-document VBS files to Windows users and installing a preconfigured remote management agent for attacker access.
News · June 22, 2026
ShapedPlugin Pro Plugins Backdoored: Check WordPress Sites Now
ShapedPlugin Pro plugin updates were backdoored through official channels. Check for fake WooCommerce plugins, rotate credentials, and install verified clean builds.
News · June 22, 2026
AryStinger Botnet Turns Old D-Link Routers Into Attack Proxies
AryStinger malware has compromised more than 4,300 legacy routers, mostly D-Link DIR-850L devices, for scanning, tunneling, and proxying attacks.
News · June 20, 2026
Gravity SMTP CVE-2026-4020: Patch WordPress Email Key Leak
Gravity SMTP sites running version 2.1.4 or older should update to 2.1.5, rotate exposed email API keys, and check logs for the mock-data REST...
News · June 20, 2026
FortiBleed Fortinet Leak: Reset VPN Credentials Now
CISA is urging Fortinet customers to harden FortiGate devices after FortiBleed reports exposed VPN and admin credentials for tens of thousands of firewalls.
News · June 19, 2026
Klue Salesforce OAuth Breach: CRM Data Stolen Through Trusted App
Salesforce disabled Klue Battlecards after attackers abused OAuth tokens to pull CRM data from connected customer environments. Here is what affected teams should check...
News · June 19, 2026
SocGholish Operation Endgame: 15,000 WordPress Sites Cleaned
International law enforcement disrupted SocGholish/FakeUpdates infrastructure and says nearly 15,000 compromised WordPress sites were remediated.
