Qualys
@qualysofficial.bsky.social
The official Blue Sky channel for Qualys the leading provider of #cloud #security and #compliance solutions. www.qualys.com
Qualys named a Leader and Outperformer in the 2025 GigaOm Radar for CNAPP.
What sets us apart? Our platform brings together hybrid cloud CNAPP, WebApp & API Security, & Compliance helping organizations achieve measurable results. Report:
bit.ly/4sZMOgl
#CloudSecurity
What sets us apart? Our platform brings together hybrid cloud CNAPP, WebApp & API Security, & Compliance helping organizations achieve measurable results. Report:
bit.ly/4sZMOgl
#CloudSecurity
January 27, 2026 at 6:14 AM
Qualys named a Leader and Outperformer in the 2025 GigaOm Radar for CNAPP.
What sets us apart? Our platform brings together hybrid cloud CNAPP, WebApp & API Security, & Compliance helping organizations achieve measurable results. Report:
bit.ly/4sZMOgl
#CloudSecurity
What sets us apart? Our platform brings together hybrid cloud CNAPP, WebApp & API Security, & Compliance helping organizations achieve measurable results. Report:
bit.ly/4sZMOgl
#CloudSecurity
Microsoft’s January #PatchTuesday fixes 115 vulnerabilities, including 3 zero-days (1 actively exploited) and 8 critical issues. Learn how to assess vendor guidance & reduce risk with #Qualys Policy Compliance. Read the Threat Research Unit (TRU) blog: https://bit.ly/3NJiwy3
January 14, 2026 at 4:27 AM
Microsoft’s January #PatchTuesday fixes 115 vulnerabilities, including 3 zero-days (1 actively exploited) and 8 critical issues. Learn how to assess vendor guidance & reduce risk with #Qualys Policy Compliance. Read the Threat Research Unit (TRU) blog: https://bit.ly/3NJiwy3
Cybersecurity leaders grapple with technology sprawl, expanding security stacks, & overwhelming telemetry volumes. TechObserver chats with #Qualys' Richard Seiersen on how to align security decisions with business value in 2026. .https://bit.ly/4qxFfLI
#CyberSecurity #AI #CISO
#CyberSecurity #AI #CISO
January 5, 2026 at 10:25 PM
Cybersecurity leaders grapple with technology sprawl, expanding security stacks, & overwhelming telemetry volumes. TechObserver chats with #Qualys' Richard Seiersen on how to align security decisions with business value in 2026. .https://bit.ly/4qxFfLI
#CyberSecurity #AI #CISO
#CyberSecurity #AI #CISO
To our customers, partners, and #TeamQualys: thank you for your trust, collaboration, and shared commitment to securing the digital world. We look forward to continuing to build, innovate & push the boundaries of cyber risk reduction—together.
Happy New Year from #TeamQualys 🎉
Happy New Year from #TeamQualys 🎉
December 31, 2025 at 7:30 PM
To our customers, partners, and #TeamQualys: thank you for your trust, collaboration, and shared commitment to securing the digital world. We look forward to continuing to build, innovate & push the boundaries of cyber risk reduction—together.
Happy New Year from #TeamQualys 🎉
Happy New Year from #TeamQualys 🎉
CVE-2025-14847 demands immediate patching. A high-severity MongoDB Server flaw enables a pre-auth, unauthenticated remote memory disclosure via zlib message decompression. Read the blog for details: https://bit.ly/49uoL1f
December 30, 2025 at 8:45 PM
CVE-2025-14847 demands immediate patching. A high-severity MongoDB Server flaw enables a pre-auth, unauthenticated remote memory disclosure via zlib message decompression. Read the blog for details: https://bit.ly/49uoL1f
Earlier this week, we warned about two zero-day WebKit flaws used in attacks. Apple has now released a critical iOS update to patch them. @Qualys’ Mayuresh Dani says the bugs were likely chained, a hallmark of spyware. Update your iPhone ASAP!
https://bit.ly/4joLU8V via @forbes.com
https://bit.ly/4joLU8V via @forbes.com
December 19, 2025 at 8:53 PM
Earlier this week, we warned about two zero-day WebKit flaws used in attacks. Apple has now released a critical iOS update to patch them. @Qualys’ Mayuresh Dani says the bugs were likely chained, a hallmark of spyware. Update your iPhone ASAP!
https://bit.ly/4joLU8V via @forbes.com
https://bit.ly/4joLU8V via @forbes.com
Apple has issued security updates to fix 2 zero-day vulnerabilities in WebKit. Both CVEs have been exploited in the wild in highly targeted attacks and can be exploited by processing maliciously crafted web content. Get the details here: https://bit.ly/3YD2hVr
#ThreatProtection
#ThreatProtection
December 17, 2025 at 4:46 PM
Apple has issued security updates to fix 2 zero-day vulnerabilities in WebKit. Both CVEs have been exploited in the wild in highly targeted attacks and can be exploited by processing maliciously crafted web content. Get the details here: https://bit.ly/3YD2hVr
#ThreatProtection
#ThreatProtection
Google patched an actively exploited Chrome zero-day, the eighth one this year. Details remain limited, but exploitation has been confirmed and users are urged to update immediately. Read the blog for affected versions and mitigation guidance: https://bit.ly/48KQDOx
December 13, 2025 at 4:47 PM
Google patched an actively exploited Chrome zero-day, the eighth one this year. Details remain limited, but exploitation has been confirmed and users are urged to update immediately. Read the blog for affected versions and mitigation guidance: https://bit.ly/48KQDOx
December’s @MsftSecIntel Patch Tuesday addresses 72 CVEs – 3 critical & 55 important. It also addresses 3 0-day CVEs, 1 exploited, 7 2 publicly disclosed. Details here: https://bit.ly/4oKVR1c
Join our webinar 12/11 for expert insights from @Qualys TRU: https://bit.ly/4prS4XJ
Join our webinar 12/11 for expert insights from @Qualys TRU: https://bit.ly/4prS4XJ
December 9, 2025 at 8:15 PM
December’s @MsftSecIntel Patch Tuesday addresses 72 CVEs – 3 critical & 55 important. It also addresses 3 0-day CVEs, 1 exploited, 7 2 publicly disclosed. Details here: https://bit.ly/4oKVR1c
Join our webinar 12/11 for expert insights from @Qualys TRU: https://bit.ly/4prS4XJ
Join our webinar 12/11 for expert insights from @Qualys TRU: https://bit.ly/4prS4XJ
React & Next.js fixed critical flaws in React Server Components & the Next.js App Router. Exploitation of the React Flight protocol could let attackers send crafted HTTP requests & execute code on servers. Learn more about affected versions & mitigations: https://bit.ly/48FnmDj
December 8, 2025 at 9:00 PM
React & Next.js fixed critical flaws in React Server Components & the Next.js App Router. Exploitation of the React Flight protocol could let attackers send crafted HTTP requests & execute code on servers. Learn more about affected versions & mitigations: https://bit.ly/48FnmDj
A critical Fortinet FortiWeb auth bypass (CVE-2025-64446) is being actively exploited, giving attackers full control of vulnerable devices. CISA has added it to the KEV with a Nov 21 deadline. Learn about the exploit, affected versions, & mitigation steps: https://bit.ly/4o0shEt
November 15, 2025 at 2:27 AM
A critical Fortinet FortiWeb auth bypass (CVE-2025-64446) is being actively exploited, giving attackers full control of vulnerable devices. CISA has added it to the KEV with a Nov 21 deadline. Learn about the exploit, affected versions, & mitigation steps: https://bit.ly/4o0shEt
Oracle has issued its third Critical Patch Update of the year, addressing 374 vulnerabilities across its portfolio. Oracle Communications received the most fixes, followed by Communications Applications and Financial Services. Read the full analysis: https://bit.ly/4noXkd5
October 23, 2025 at 3:19 PM
Oracle has issued its third Critical Patch Update of the year, addressing 374 vulnerabilities across its portfolio. Oracle Communications received the most fixes, followed by Communications Applications and Financial Services. Read the full analysis: https://bit.ly/4noXkd5
F5 has disclosed a long-term breach by a nation-state attacker involving stolen BIG-IP source code & unpatched vulnerabilities. With CISA warning of an imminent threat, organizations must quickly identify exposed assets & speed up remediation. Read more: https://bit.ly/4oy4nRG
October 21, 2025 at 12:27 AM
F5 has disclosed a long-term breach by a nation-state attacker involving stolen BIG-IP source code & unpatched vulnerabilities. With CISA warning of an imminent threat, organizations must quickly identify exposed assets & speed up remediation. Read more: https://bit.ly/4oy4nRG
Oracle addressed a high-severity vulnerability in its E-Business Suite. Exploitation could let an unauthenticated remote attacker compromise Oracle Configurator Runtime UI. Read the blog for affected versions and mitigation guidance: https://bit.ly/3W5B4cU
#ThreatProtection
#ThreatProtection
October 14, 2025 at 10:59 PM
Oracle addressed a high-severity vulnerability in its E-Business Suite. Exploitation could let an unauthenticated remote attacker compromise Oracle Configurator Runtime UI. Read the blog for affected versions and mitigation guidance: https://bit.ly/3W5B4cU
#ThreatProtection
#ThreatProtection
Expert-led cybersecurity training at #ROCon25. Here’s a glimpse as our instructor walks through the 5 Steps to TruRisk Reduction dashboard – demonstrating how to identify what truly needs your focus across complex vulnerability data.
#RiskManagement
#RiskManagement
October 14, 2025 at 7:50 PM
Expert-led cybersecurity training at #ROCon25. Here’s a glimpse as our instructor walks through the 5 Steps to TruRisk Reduction dashboard – demonstrating how to identify what truly needs your focus across complex vulnerability data.
#RiskManagement
#RiskManagement
This month’s @MsftSecIntel Patch Tuesday fixes 193 vulnerabilities, including 9 Critical & 6 zero-days, with 4 actively exploited & 2 publicly disclosed. Get the details in this blog: https://bit.ly/48vQNcH.
Join the @Qualys TRU webinar this Thursday: https://bit.ly/474T78a
Join the @Qualys TRU webinar this Thursday: https://bit.ly/474T78a
October 14, 2025 at 7:45 PM
This month’s @MsftSecIntel Patch Tuesday fixes 193 vulnerabilities, including 9 Critical & 6 zero-days, with 4 actively exploited & 2 publicly disclosed. Get the details in this blog: https://bit.ly/48vQNcH.
Join the @Qualys TRU webinar this Thursday: https://bit.ly/474T78a
Join the @Qualys TRU webinar this Thursday: https://bit.ly/474T78a
Broadcom addressed a critical CVE in VMware’s guest service discovery features. Exploitation could allow an unprivileged user to escalate privileges to root on the same VM. Researchers confirmed that it has been exploited in the wild. Learn more: https://bit.ly/4mKu9Rq
October 2, 2025 at 3:28 PM
Broadcom addressed a critical CVE in VMware’s guest service discovery features. Exploitation could allow an unprivileged user to escalate privileges to root on the same VM. Researchers confirmed that it has been exploited in the wild. Learn more: https://bit.ly/4mKu9Rq
Researchers discovered a malicious modification in the npm package postmark-mcp. By adding a blind copy to an external domain, attackers secretly exfiltrated email contents. This is the first known case of an MCP server exploited in the wild. Blog: https://bit.ly/474o8dy
September 30, 2025 at 7:28 PM
Researchers discovered a malicious modification in the npm package postmark-mcp. By adding a blind copy to an external domain, attackers secretly exfiltrated email contents. This is the first known case of an MCP server exploited in the wild. Blog: https://bit.ly/474o8dy
SolarWinds fixed a critical CVE in its Web Help Desk software. Successful exploitation of the flaw could allow an unauthenticated attacker to execute arbitrary code on the target system. Learn more about the vulnerability, affected versions & mitigation: https://bit.ly/46yJPAZ
September 26, 2025 at 9:06 PM
SolarWinds fixed a critical CVE in its Web Help Desk software. Successful exploitation of the flaw could allow an unauthenticated attacker to execute arbitrary code on the target system. Learn more about the vulnerability, affected versions & mitigation: https://bit.ly/46yJPAZ
@Cisco patched a critical zero-day flaw in IOS & IOS XE Software. Exploitation could let low-privileged attackers cause DoS, while high-privileged attackers could execute code as root and fully compromise systems. Read the blog for mitigation details: https://bit.ly/3IChLok
September 25, 2025 at 11:16 PM
@Cisco patched a critical zero-day flaw in IOS & IOS XE Software. Exploitation could let low-privileged attackers cause DoS, while high-privileged attackers could execute code as root and fully compromise systems. Read the blog for mitigation details: https://bit.ly/3IChLok
Fortra released security updates for a critical flaw (CVE-2025-10035) in GoAnywhere MFT License Servlet. With a CVSS of 10, exploitation could allow unauthenticated remote code execution. Learn more in this blog: https://bit.ly/4nkBFDA
#ThreatProtection #VulnerabilityManagement
#ThreatProtection #VulnerabilityManagement
September 23, 2025 at 4:41 PM
Fortra released security updates for a critical flaw (CVE-2025-10035) in GoAnywhere MFT License Servlet. With a CVSS of 10, exploitation could allow unauthenticated remote code execution. Learn more in this blog: https://bit.ly/4nkBFDA
#ThreatProtection #VulnerabilityManagement
#ThreatProtection #VulnerabilityManagement
Attackers exploited SharePoint ToolShell flaws to hit 145+ orgs, incl. US agencies. The campaign persisted even after patches with stealth tactics. Saeed Abbasi of @qualys.bsky.social says that when patching isn’t possible, use advanced remediation: https://bit.ly/3K6LbeU via @ismsonline.bsky.social
September 19, 2025 at 5:45 PM
Attackers exploited SharePoint ToolShell flaws to hit 145+ orgs, incl. US agencies. The campaign persisted even after patches with stealth tactics. Saeed Abbasi of @qualys.bsky.social says that when patching isn’t possible, use advanced remediation: https://bit.ly/3K6LbeU via @ismsonline.bsky.social
Google released security updates to fix a critical CVE in the Chrome browser. Successful exploitation of the type confusion flaw in the V8 JavaScript & WebAssembly engine, has already been observed in the wild by Google Threat Analysis Group. Learn more: https://bit.ly/42EBpa1
September 19, 2025 at 1:40 PM
Google released security updates to fix a critical CVE in the Chrome browser. Successful exploitation of the type confusion flaw in the V8 JavaScript & WebAssembly engine, has already been observed in the wild by Google Threat Analysis Group. Learn more: https://bit.ly/42EBpa1
Over 400 npm packages have been compromised in in an ongoing supply chain attack. With 2.6B weekly downloads, thousands of apps are at risk, along with likelihood of further impact. No patches yes, users should uninstall the affected packages. Learn more: https://bit.ly/3IpDoZ3
September 17, 2025 at 8:07 PM
Over 400 npm packages have been compromised in in an ongoing supply chain attack. With 2.6B weekly downloads, thousands of apps are at risk, along with likelihood of further impact. No patches yes, users should uninstall the affected packages. Learn more: https://bit.ly/3IpDoZ3
Ivanti released its Sept security bulletin, addressing 13 CVEs across its popular products. There is currently no evidence of active exploitation.
Get the details in this blog, including exploitation methods, affected versions, & detection steps: https://bit.ly/46kQWNs
#VulnerabilityManagement
Get the details in this blog, including exploitation methods, affected versions, & detection steps: https://bit.ly/46kQWNs
#VulnerabilityManagement
September 12, 2025 at 8:55 PM
Ivanti released its Sept security bulletin, addressing 13 CVEs across its popular products. There is currently no evidence of active exploitation.
Get the details in this blog, including exploitation methods, affected versions, & detection steps: https://bit.ly/46kQWNs
#VulnerabilityManagement
Get the details in this blog, including exploitation methods, affected versions, & detection steps: https://bit.ly/46kQWNs
#VulnerabilityManagement