Lena Vasquez
Security correspondent.
Lena Vasquez covers vulnerabilities, breaches and identity for Five Nines. She writes from advisories, vendor bulletins and published reporting.
See our editorial standards.
Stories by Lena Vasquez
- DOMPurify advisory
DOMPurify shadow root gap lets template expressions survive sanitization
A GitHub advisory says DOMPurify's post-walk scrub misses attached shadow roots, allowing split template expressions to re-form and execute when SAFE_FOR_TEMPLATES and DOM-returning modes are used. No fix is available.
Lena Vasquez Oct 22, 21:37 UTC · 2 min read
- ConnectWise breach
Microsoft links ConnectWise breach to China-linked Storm-0940
Attackers used the ARTEX AI tool to try to authenticate against more than 2,250 Microsoft 365 tenants, sometimes gaining privileged access in under three hours.
Lena Vasquez Oct 22, 20:39 UTC · 2 min read
- Pillow TIFF
Pillow heap overflow strikes TIFF saves to BytesIO
A flaw in Pillow's libtiff write callback lets crafted TIFF uploads overwrite heap memory or leak stale bytes when saved to a BytesIO, with no special save options; fixed in Pillow 13.0.0.
Lena Vasquez Oct 22, 20:28 UTC · 2 min read
- Next.js image optimization
Next.js patches critical unauthenticated RCE in image optimization
The flaw affects Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. Patched releases are 15.5.28 and 16.4.1.
Lena Vasquez Oct 22, 20:11 UTC · 1 min read
- VeloCloud Orchestrator
Arista patches exploited VeloCloud Orchestrator zero-day
The critical SQL injection flaw in on-premises VCO lets authenticated users become superuser operators; fixes are in 5.2.3.18, 6.1.3.10, and 6.4.2.12 or later.
Lena Vasquez Oct 22, 19:57 UTC · 1 min read
- Sentry SDK
Sentry patches SDK flaw that skipped middleware
The flaw affects Next.js apps built with webpack when tunnelRoute is set, and middleware is the only authorization check.
Lena Vasquez Oct 22, 19:43 UTC · 1 min read
- CISA PHP alert
CISA tells PHP admins to patch two php2shell flaws now
The unauthenticated remote code execution bugs affect all PHP installations serving web requests; updates are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Lena Vasquez Oct 22, 17:22 UTC · 1 min read