Vulnerability Management
In-depth guides and analysis on vulnerability management from the Safeguard engineering team.
100 articles
OpenSSL 3.4 Support Ended 22 October; OpenSSL 3.6 Ends 1 November 2026
OpenSSL 3.4 lost upstream support on 22 October 2026 and 3.6 ends on 1 November. Where they still ship, how to check each runtime, and what to move to.
Next.js 15 Reached End of Life on 21 October 2026: How to Move to 16
Next.js 15 left Maintenance LTS on 21 October 2026. The last 15.x fixes, how to find every 15.x app in your estate, and a tested path to Next.js 16.
aiohttp 3.14.4 Fixed Eight Advisories: Labeled Low, Scored Up to 8.2, and What Changes When You Upgrade
aiohttp 3.14.4 fixed eight advisories rated low or medium by the project, scored up to 8.2 in CVE records. What they cover, upgrade changes, a checker.
PostgreSQL 14 End of Life on 12 November 2026: What 2026 Fixed and How to Upgrade
PostgreSQL 14's final release is due on 12 November 2026. This year it needed fixes for 36 CVEs, 22 rated 8.0 or higher. The community and Amazon RDS dates that apply, two security defaults a 14-to-18 upgrade doesn't change for you, and a script that finds every pinned PostgreSQL version in a repository.
zvariant Is Unmaintained: Why cargo deny Fails and How to Move to zbus 6
RustSec marked zvariant, zvariant_derive and zbus_names unmaintained after zbus 6.0 merged them, and cargo-deny fails on that by default. How far it reaches (523 of 637 zbus dependents still on zbus 5), what each tool does, the three situations you can be in, the zbus 6 migration essentials, and a Cargo.lock checker.
"Fully Compromised": What 7,700 npm Malware Advisories Say, and What the Analysis Adds
GitHub's npm malware advisories tell you to treat the machine as fully compromised and rotate every secret. OSV's 2026 data: 7,700 npm records carry that paragraph, 2,018 carry nothing else, and 5,682 include an analysis of what the code did. Where they part ways, and a script to scope your response.
CSAF 2.0 for Software Vendors: Publishing Security Advisories Machines Can Read
What CSAF 2.0 requires, a minimal security advisory that passes the official schema, how customers discover your advisories through provider-metadata.json, and two small scripts to check your own work.
A Clean Scan Can Also Mean the Vulnerability Data Hasn't Caught Up
A dependency scan that reports nothing has one of two meanings. Either the scanner checked your packages and the vulnerability data found nothing wrong, or the data didn't yet know about something that is wrong. Both produce the same green build.
How to Read a CVE Record in Code: CVE JSON 5, Affected Versions and CISA Vulnrichment
A CVE record in the JSON 5 format can say precisely which versions are affected, but it can also say it in free text, say nothing, or contradict itself. How to read one correctly, with five real records from this week and data from 1,197 new records.
Has My Distro Shipped the Fix? Checking Debian, Ubuntu, Red Hat and Alpine Security Data for Any CVE
Upstream fix versions don't tell you whether your distribution has shipped the fix, because Debian, Ubuntu and Red Hat backport fixes into the versions they already ship. Where each distribution publishes fix status, what it means, and a script that checks all four for any CVE.
What to Do With a Critical Vulnerability That Has No Fix
Every remediation process assumes a patch exists. When the maintainer is gone and the package sits three levels deep in a tree you do not control, you need a different workflow: narrow the exposure, then decide, document, control and expire.
A Clean Scan Usually Means the Scanner Did Not Look
Analysed your code and found nothing, or failed to analyse your code and therefore found nothing. Most tools report both as success. Seven reasons coverage collapses, and the canary dependency that proves a scan still works.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.