Security
Insights, tutorials and best practices from the world of Cloud, DevOps and Open Source
PHP Update 8.5.12, 8.4.27, 8.3.36 and 8.2.35: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), Affected Software and Measures
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution: CVE-2026-109618 and CVE-2026-109619, each CVSS 4.0 9.2, called...
#PHP2Shell#CVE#RCERead more
Nextcloud Built-in CODE Server: Unauthenticated Command Injection (CVE-2026-110447), Update to 26.4.303 or Remove the App
A Nextcloud with the app Collabora Online - Built-in CODE Server (richdocumentscode) in version 26.4.302 or older can be made to run operating system commands...
#Collabora#CVE#RCERead more
n8n Security Update September 2026: 14 Advisories, Fixed Versions and Hardening
On 30 September 2026 n8n published 14 new security advisories, ten rated high and four rated medium. Three of the vulnerabilities can be reached without...
#Security#Workflow#AutomationRead more
LiteLLM Vulnerability GHSA-7hp6-4w63-5g45: Check Versions and Harden the Gateway
On 30 September 2026, BerriAI published a security advisory for the LiteLLM proxy: GHSA-7hp6-4w63-5g45. An authenticated user with the internaluser role can escalate to proxyadmin...
#Security#AI#LLMGatewayRead more
OpenBao or HashiCorp Vault: secrets management after the licence change
HashiCorp Vault has been the default answer to central management of credentials and certificates for years. Since the 2023 licence change, OpenBao sits alongside it,...
#Vault#Secrets#BSLRead more
CRA reporting obligation from 11 September 2026: who reports, what and when
On 11 September 2026 the first operational obligation of the Cyber Resilience Act takes effect. It is narrowly scoped: it concerns reporting only, not conformity...
#CRA#Compliance#VulnerabilityManagementRead more
Free intro call
Let's talk about your project - no obligation
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
Let's Talk About Your Idea
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.