The Varnish Blog

Insights, updates, stories and more from Varnish

Featured Post

VCL Security PHP

Protecting PHP sites from CVE-2026-109618 with Varnish

If you run PHP behind Varnish, you can block the reported attack path for CVE-2026-109618 and CVE-2026-109619 at the...

JFrog Xray Block Download deprecation: what changes?

JFrog is moving download blocking for remote repositories from Xray to JFrog Curation. Its published rollout runs from...

Varnish Artifact Firewall in the time of Black October

A malicious LiteLLM release was live on PyPI for 1 hour and 43 minutes. What October's attacks teach, the control that...

Two years of NIS2: sovereign infrastructure as an insurance policy

In brief: two years after its transposition deadline, NIS2 is finally being enforced, and recent events have shifted...

Protecting PHP sites from CVE-2026-109618 with Varnish

If you run PHP behind Varnish, you can block the reported attack path for CVE-2026-109618 and CVE-2026-109619 at the...

The Cyber Resilience Act as Insurance

I just got back from Open Source Summit, and one topic followed me from hallway to hallway: the EU Cyber Resilience Act.