Section
Research
Threat intelligence and technical research from vendor labs, coordination centers and independent researchers.
7 matching records.
-
Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
Executive Summary PHP2Shell’s fix is to update PHP, but patching at scale is slow. Only 199,000 of 156 million PHP installations were patched in the first 12 hours after disclosure. In the meantime, Qualys’s configuration-level…
-
How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943)
Executive Summary A critical certificate authority incident disclosed on October 17, 2026, impacts eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and…
-
Operationalizing CISA AA26-194A: Automating Cisco Router Security Assessments with Qualys Policy Audit
Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. The advisory focuses on configuration hardening and security hygiene, rather…
-
Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own
Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3…
-
The Real Jump Scare Isn’t the Attacker; It’s The Vulnerabilities You’re Focusing On
Key Takeaways Teams are remediating more than ever, but exposure from the vulnerabilities that matter is still rising faster than they can keep up with. Mean time to exploitation is about −7 days. Mean time to remediate sits…
-
Exploitability Needs Runtime Evidence: Understanding Runtime Vulnerability Reachability for Containers
Key Takeaways Qualys Runtime Vulnerability Reachability for Containers brings runtime evidence directly into vulnerability prioritization. Package presence in a container image does not mean the vulnerable software is actually…
-
Secure Your Mission-Critical Application Estate: Qualys TotalAppSec is Now FedRAMP High Authorized (FedRAMP Certified Class D)
Key Takeaways Qualys TotalAppSec is now FedRAMP High Authorized on the Qualys Government Platform (FedRAMP Certified Class D, package FR2231052341). Federal AI use cases more than doubled in a year (3,611 use cases across 56…
Reuse this view
Same filters as JSON: /api/items?category=research&window=30d&vendor=Qualys&limit=100. RSS for this section: feed.xml.