Back to all posts
RSS for Slack
Two circular segmented charts with red and blue segments, each showing a partial ring. The left circle has blue segments at the top and red at the bottom; the right circle has a mixed color pattern. upwind logo is in the top left corner.
Research

io_uring: Linux Performance Boost or Security Headache?

The Linux kernel is constantly evolving, and one of the significant additions in recent years is io_uring. Introduced in kernel 5.1 (2019), it’s designed to dramatically speed up input/output (I/O) operations. But as with many powerful tools, it brings new security considerations. Let’s break down what io_uring is, the risks it presents, and how to […]

Blue and red gradient lines curve upward against a light blue background, intersected by orange circles. The word upwind with an underlined u appears in the upper left corner.
Research

Unpacking the Security Risks of Model Context Protocol (MCP) Servers

Modern AI systems, especially large language models (LLMs), are no longer isolated engines responding to static inputs. They’re evolving into intelligent agents, copilots, and autonomous systems that interact with their environment, reason over external data, and adapt in real time. But there’s a fundamental problem: LLMs are powerful, but they don’t know anything outside of […]

A white warning icon with an exclamation mark is centered on a bright pink, patterned background. Below it, text reads: CVE-2025-32433: Critical Erlang/OTP SSH Vulnerability (CVSS 10).
Research

CVE-2025-32433: Critical Erlang/OTP SSH Vulnerability (CVSS 10)

On April 16, 2025, a critical remote code execution (RCE) vulnerability in Erlang’s SSH library was publicly disclosed. Tracked as CVE-2025-32433, this vulnerability received the maximum possible CVSS score of 10.0, signaling how severe and exploitable it is, especially in environments relying on Erlang/OTP for SSH access. Overview What is CVE-2025-32433? Discovered by researchers at […]

Hexagonal icon with an N inside on a pink gradient background with angular lines. Text: IngressNightmare: Admission Webhook Flaw Leading to Remote Code Execution (CVE-2025-1974).
Research

IngressNightmare: How New ingress-nginx Vulnerabilities Threaten Kubernetes Clusters

Kubernetes administrators take note: a critical set of vulnerabilities in the popular ingress-nginx controller—collectively dubbed “IngressNightmare”—could put your entire cluster at risk. In particular, CVE-2025-1974, with a CVSS score of 9.8, allows attackers to take over Kubernetes clusters simply by exploiting the Validating Admission Controller feature. Because ingress-nginx runs in roughly 40% of Kubernetes deployments, […]

A pink background with concentric circles and a white bug icon in the center. Text reads, Next.js Middleware Authentication Bypass Vulnerability (CVE-2025-29927). Upwind logo in the top right corner.
Research

Next.js Middleware Authentication Bypass Vulnerability (CVE-2025-29927)

Next.js middleware plays a key role in securing applications by enforcing authentication, managing access control, and applying security headers. However, a newly discovered vulnerability, CVE-2025-29927, allows attackers to bypass these protections entirely using a manipulated HTTP header. Affected Versions This flaw affects the following versions: The Core Issue Next.js prevents infinite middleware loops by tracking […]

A pink graphic with a white bug icon in the center, symbolizing a vulnerability. Text reads: Apache Tomcat Vulnerability (CVE-2025-24813) Exposes Servers to RCE Risks. Upwind logo is in the top right corner.
Research

Apache Tomcat Vulnerability (CVE-2025-24813) Exposes Servers to RCE Risks

A critical security vulnerability, identified as CVE-2025-24813, has been discovered in Apache Tomcat, potentially exposing servers to remote code execution (RCE), information disclosure, and data corruption risks. This flaw affects the following versions:​ Understanding CVE-2025-24813 The vulnerability originates from improper handling of path equivalence when processing filenames that contain internal dots. Specifically, when Tomcat’s default […]

Warning icon with an exclamation mark on a pink background with concentric circles. Text below reads: GitHub Actions Supply Chain Compromise: tj-actions/changed-files Action.
Research

GitHub Actions Supply Chain Compromise: tj-actions/changed-files Action

We are actively responding to a significant security breach involving the widely used GitHub Action, tj-actions/changed-files. Current findings indicate that nearly all tagged versions of tj-actions/changed-files have been compromised, resulting in direct access to running containers and virtual machines’ memory, allowing the extraction of sensitive secrets, information, and code. This is happening through the following command […]

A red and pink background with concentric circles features a white bug icon in the center. Text below reads: python-json-logger Supply Chain Remote Code Execution Vulnerability (CVE-2025-27607). Upwind logo is at the top right.
Research

Supply Chain Remote Code Execution in python-json-logger CVE-2025-27607

A critical Remote Code Execution (RCE) vulnerability was recently discovered in python-json-logger, a widely used Python package for structured logging. This flaw, affecting versions 3.2.0 and 3.2.1, arises due to a missing dependency: msgspec-python313-pre. The package was deleted from PyPI, leaving its name unclaimed. This vulnerability highlights a recurring yet dangerous issue in software supply […]

A pink and red gradient graphic with a target symbol at the center. Text reads: OpenSSH Vulnerabilities Enable Man-in-the-Middle and DoS Attacks (CVE-2025-26465 & CVE-2025-26466). The upwind logo is in the top right corner.
Research

OpenSSH Vulnerabilities CVE-2025-26465 and CVE-2025-26466 Enable Man-in-the-Middle and DoS Attacks

On February 18, 2025, two critical vulnerabilities were disclosed in OpenSSH, a widely used secure networking utility suite. These flaws, identified as CVE-2025-26465 and CVE-2025-26466, pose significant security risks: Discovery and Response The vulnerabilities were uncovered by the Qualys Threat Research Unit (TRU). They affect OpenSSH client versions 6.8p1 through 9.9p1 and 9.5p1 through 9.9p1, […]

Add the Upwind RSS Feed to Slack

Connect the Upwind RSS Feed to your Slack.
Follow the how-to here.