VulnHub

OpenSSL has patched 12 vulnerabilities, including a high-severity flaw that allows remote code execution. This vulnerability was identified by a cybersecurity firm and poses significant risks for users and organizations relying on OpenSSL for secure communications. Attackers could exploit this flaw to execute arbitrary code on affected systems, potentially compromising sensitive data and operations. Users and organizations should prioritize applying the latest updates to safeguard their systems against potential attacks. The patch addresses critical issues that could affect a wide range of applications and services leveraging OpenSSL, making timely remediation essential.

Microsoft is looking into issues with some Windows 11 devices that are failing to boot after users installed the January 2026 Patch Tuesday security updates. Affected users are encountering 'UNMOUNTABLE_BOOT_VOLUME' errors, which prevent their systems from starting up properly. This situation could disrupt the workflow of many individuals and organizations that rely on Windows 11 for daily operations. Microsoft has not yet provided a specific fix or workaround for the problem, leaving users uncertain about how to resolve the issue. The investigation is ongoing as the company seeks to identify the root cause of the boot failures and implement a solution.

A serious vulnerability has been discovered in all versions of GNU InetUtils telnetd, specifically those ranging from 1.9.3 to 2.7. This flaw, which allows remote attackers to bypass authentication, has gone unnoticed for nearly 11 years. Given the age of this issue, many systems may still be running vulnerable versions, putting users at risk. The discovery emphasizes the need for organizations to audit their systems and ensure they are not using outdated software. Users and administrators should take immediate action to update or patch their systems to mitigate potential exploitation.

Anthropic has addressed several critical vulnerabilities found in their Git MCP server, identified by the AI security startup Cyata. The issues include a path validation bypass (CVE-2025-68145), an unrestricted git_init problem (CVE-2025-68143), and an argument injection vulnerability in git_diff (CVE-2025-68144). These vulnerabilities could potentially allow attackers to manipulate Git operations, which could compromise the integrity of code repositories. It is essential for users of the Git MCP server to apply the latest patches to ensure their systems are secure against these threats, as failure to do so may expose them to exploitation. Users are urged to stay informed about these vulnerabilities and take necessary actions to protect their environments.

Cloudflare has patched a vulnerability in its Web Application Firewall (WAF) that could allow attackers to bypass security measures and gain direct access to servers. This vulnerability was identified by researchers from FearsOff in October and reported through Cloudflare's bug bounty program. Companies using Cloudflare’s WAF should be aware that this issue posed a risk of unauthorized access to their systems. The patch has been released to mitigate this risk, and it’s crucial for users to apply the updates promptly to ensure their applications remain secure. Staying ahead of such vulnerabilities is essential for maintaining the integrity of web applications.

GitLab has issued a security patch for a serious vulnerability that allows attackers to bypass two-factor authentication (2FA) in both its community and enterprise editions. This flaw could potentially give unauthorized users access to sensitive accounts if exploited. Additionally, GitLab addressed issues related to denial-of-service (DoS) attacks, which could disrupt services for legitimate users. The company advises all users to update their systems promptly to mitigate these risks. This situation emphasizes the importance of keeping software up to date to protect against emerging threats.

In January 2026, Oracle released its first Critical Patch Update (CPU) of the year, addressing approximately 230 unique vulnerabilities across over 30 of its products. This update includes a total of 337 new security patches, which users are encouraged to apply to protect their systems. These vulnerabilities could potentially expose systems to various security risks, making it crucial for affected organizations to implement the patches promptly. The update reflects Oracle's ongoing commitment to security, as it aims to mitigate risks associated with its software products. Users and administrators should ensure they are running the latest versions to safeguard against potential exploitation.

Microsoft has rolled out emergency updates for Windows 10, Windows 11, and Windows Server to address issues that arose from the January Patch Tuesday updates. These out-of-band updates specifically target problems related to system shutdowns and Cloud PC functionality. Users of these operating systems may experience disruptions due to these bugs, which could impact productivity and system reliability. It's crucial for users to apply these updates promptly to ensure their systems operate smoothly and to mitigate any potential security risks that may arise from unresolved bugs.