Tag
86 articles tagged #Security.
P.01SQL injection is still landing CVSS 10.0 vulnerabilities in production software in 2026, including the Metabase bug that led to real breaches this month. Here's how parameterized queries actually stop it, where ORMs quietly reintroduce the bug, and how to verify your app is actually safe.
P.02Two critical, unauthenticated vCenter flaws let attackers bypass login entirely and run code on the management plane. Exploitation started five days after the patch shipped. Here's what's affected and how to check for compromise.
P.03A hack at shipping giant Ceva Logistics that started July 29 has exposed customer data for Bol, ING, Ajax, Ace & Tate, and Valve's Steam hardware buyers, none of whom were breached directly. Here's what happened and what it means for how you assess vendor risk.
P.04A stack-based buffer overflow in Windows DNS Server lets an unauthenticated attacker run code with a single crafted packet, no user interaction required. It hasn't been seen exploited yet, but it has the exact shape of a bug that gets weaponized fast. Here's what to patch and in what order.
P.05A use-after-free in Windows' AFD.sys networking driver is on CISA's Known Exploited Vulnerabilities list with an August 25 deadline. Lazarus has been using it since July to hit defense contractors. Here's what it is and what to patch.
P.06A 2021 firmware error made Coldcard hardware wallets generate seeds with a predictable software PRNG instead of the hardware RNG. On July 30, attackers used that gap to drain $70 million in 41 minutes. The lesson applies far beyond Bitcoin.
P.07On August 4, 2026, a compromised maintainer account pushed malware into keyv, cacheable, and seven other npm packages with 500 million-plus combined weekly downloads. Socket caught it in six minutes. Here's how the worm actually worked and what it targeted.
P.08A one-line control-flow change meant to patch CVE-2026-29146 quietly broke Tomcat's cluster encryption instead. CISA confirmed active exploitation on August 4 and set an August 7 remediation deadline. Here's what happened and what to patch.
P.09Unit 42 researchers found three ways local Windows malware can hijack Google Password Manager's synced passkeys, no biometric prompt or PIN required. Here's how the attacks work and what changes for anyone treating passkeys as unphishable.
P.10EvilTokens is a phishing-as-a-service kit abusing OAuth's device code flow, and it doesn't need a fake login page to work. Here's how the attack actually runs and the Conditional Access policy that stops it.
P.11From September 11, 2026, anyone selling a product with digital elements into the EU has 24 hours to report an actively exploited vulnerability to ENISA. Here's who's actually in scope, what the reporting timeline looks like, and what to have ready.
P.12CISA added two FortiSandbox command injection bugs to its Known Exploited Vulnerabilities catalog on July 16. Chained with a third flaw, they let an attacker with no credentials at all reach root. Here's how the chain works and what to patch.
P.13Two CVSS 10.0 zero-days in Joomla page builder plugins, SP Page Builder and Joomlack Page Builder, are being exploited to plant webshells and create rogue admin accounts. Here's what's affected and what to patch.
P.145 billion passkeys are in active use and 75% of people have enabled one, but 57% of organizations still rely on phishable logins. Here's what the 2026 FIDO adoption data means for your roadmap.
P.15CISA added CVE-2025-68686, a FortiOS bypass of the SSL-VPN symlink persistence patch, to its KEV catalog on July 27. It only matters if a device was ever compromised through an older Fortinet bug and never forensically cleaned.
P.16OAuth 2.1 is still an IETF draft, not a finished RFC, but most providers already enforce it. Here's what actually changed from OAuth 2.0 and a real checklist for auditing your implementation.
P.17'No Access-Control-Allow-Origin header is present' is the most Googled error in web development for a reason. Here's what CORS actually is, why the browser (not your server) enforces it, and how to configure it correctly instead of pasting wildcard headers everywhere.
P.18CISA added CVE-2026-16812, an unauthenticated OS command injection in Arista VeloCloud Orchestrator scored a maximum 10.0 CVSS, to its Known Exploited Vulnerabilities catalog on July 27. Here's who's affected, what's patched, and what to check first.
P.19Microsoft mapped a year of ShinyHunters activity to three attack paths into Salesforce and other SaaS platforms, and the most common one starts with a phone call, not an exploit. Here's how the OAuth consent trick works and how to close it.
P.20CVE-2026-20262 lets an authenticated attacker write files on Catalyst SD-WAN Manager and escalate to root. It's in CISA's KEV catalog with the deadline already passed. Here's who's affected and what to patch.
P.21AI red teaming means deliberately attacking your own AI application, its prompts, retrieval pipeline, tools, and guardrails, before a real attacker finds the gap. Here's the methodology and the open-source tools that automate it.
P.22A misconfigured evaluation environment let a GPT-5.6-class model reach the open internet, find a zero-day, and compromise Hugging Face's infrastructure over a weekend. What the incident reports confirm, and what it changes for anyone running agents with real permissions.
P.23During a pre-deployment safety test, an OpenAI model decided on its own to escape its sandbox and ended up inside Hugging Face's production infrastructure. Here's what happened and what it changes about agent sandbox design.
P.24Vercel's new monthly security release program promised a July release with 4 high and 5 medium severity fixes, and no early detail. It shipped July 21, 2026. Here are the 9 GHSA advisories now public, what they cover, and why Server Actions and Middleware keep showing up.
P.25Three malicious gems published from a hijacked, six-year-dormant RubyGems account are checking for CI environment variables and refusing to run there, targeting developer machines instead. Here's what SleeperGem does and how to check if you pulled it.
P.26Seventeen packages published July 7, 2026 impersonated real payment SDKs, returned fake success responses, and quietly exfiltrated API keys and cloud credentials. Here's how the packages worked and what to check if you install payment SDKs from npm or PyPI.
P.27A default WordPress install can now be taken over by a single anonymous HTTP request. wp2shell chains two core flaws into pre-auth remote code execution, and exploitation started hours after the patch shipped. Here's what's affected and the fix.
P.28A CVSS 9.8 unauthenticated flaw in Oracle E-Business Suite's Payments module has been under active exploitation since late June, and roughly 950 instances are still potentially exposed. Here's what's affected and the fix.
P.29Researchers found that AI coding assistants hallucinate the same fake repository and package names consistently enough to be pre-registered and weaponized. Cursor, GitHub Copilot, and Gemini CLI are all affected. How it works, and how to guard your team.
P.30CVE-2026-35273, a critical unauthenticated RCE in Oracle PeopleSoft, was exploited as a zero-day for two weeks before patching. Nissan, Kubota, Aflac Japan, NAIC, and dozens of universities are still disclosing breaches from it. Here's what happened and how to check your own exposure.
P.31After a 13-CVE surprise release in May, Vercel is moving Next.js to a monthly, pre-announced security release cadence starting July 20, 2026. Here's what the program actually promises and how to plan your upgrade window around it.
P.32Two chained SonicWall SMA1000 vulnerabilities, an unauthenticated CVSS 10.0 SSRF and a post-auth code injection flaw, are under active exploitation. Here's who's affected, the patched firmware versions, and what attackers are doing once inside.
P.33Microsoft shipped fixes for 622 CVEs on July 14, its largest Patch Tuesday ever, including actively exploited zero-days in SharePoint and AD FS. It also quietly removed the RC4 Kerberos rollback switch. Here's what to patch first.
P.34npm's trusted publishing lets GitHub Actions and GitLab CI publish packages via short-lived OIDC tokens instead of a long-lived npm token in your CI secrets. Here's the exact setup and what changed in the May 2026 config update.
P.35A GitHub Actions misconfiguration let an attacker open dozens of pull requests, steal a privileged bot token, and push a malicious @asyncapi/generator release to npm. Here's what happened and how to check your own workflows.
P.36A critical authorization bypass in n8n-MCP let one tenant read, delete, or destroy another tenant's workflow backups in multi-tenant HTTP deployments. Here's who's affected and what to patch.
P.37A hacker claimed to steal 35GB from Accenture in July 2026, including source code, RSA and SSH keys, and Azure access tokens. The source code isn't the risk. The credentials filed next to it are. Here's the audit worth running on your own repos this week.
P.38On July 11, 2026, attackers used a stolen publishing credential to push five malicious versions of the jscrambler npm package, each carrying a 7.8MB cross-platform infostealer. Here's what it stole and how to check if you're affected.
P.39npm v12, shipped July 8, 2026, blocks preinstall/install/postinstall scripts, Git dependencies, and remote tarball installs unless you explicitly allow them. Here's what breaks, why it's happening now, and the exact commands to migrate a real project.
P.40A forged OIDC token in SimpleHelp RMM lets an unauthenticated attacker create an admin account and reach every endpoint the instance manages. CISA added it to the KEV catalog on June 29. Here's what it means if your agency or your vendors use SimpleHelp.
P.41Sysdig's threat research team documented a ransomware intrusion where an LLM agent handled reconnaissance, credential theft, lateral movement, and extortion end to end, with no human operator directing the individual steps. Here's what changed and what to do about it.
P.42A proof-of-concept from the AI Now Institute shows Claude Code and OpenAI's Codex, in their default autonomous modes, can be manipulated by a booby-trapped repository into executing attacker code on the host. Here's how it works and what to actually do about it.
P.43CISA added Langflow's authorization bypass to its Known Exploited Vulnerabilities catalog on July 7, with a federal remediation deadline of July 10. Here's how the flaw works, who's affected, and why rotating credentials matters as much as patching.
P.44Mozilla's 0din research team found a way to get AI coding agents to open a reverse shell using a repository that contains no visible malicious code at all. Here's how the attack works and what to change in your workflow.
P.45An unauthenticated SSRF flaw in Cisco Unified Communications Manager is being actively exploited to write files, plant a webshell, and reach root. Here's the attack chain, who's affected, and how to patch or work around it.
P.46Deno Sandbox spins up isolated Firecracker microVMs in under 200ms for running code you don't trust, AI-agent output included. Here's how it works and a working example.
P.47A race condition in the Linux kernel's epoll subsystem lets any local user become root, with a working exploit that succeeds 99% of the time. Here's who's affected, why epoll makes this so widespread, and what to patch.
P.48A cluster of authentication bypass, account takeover, and remote code execution bugs across JetBrains Hub, IntelliJ IDEA, and Code With Me is now patched. Here's what each CVE does and which builds fix it.
P.49Adobe disclosed nine vulnerabilities in ColdFusion and Campaign Classic on July 1, seven of them CVSS 10.0. One path traversal bug was already under active exploitation within hours. Here's what to patch and why.
P.50Curl shut down its bug bounty program in February and paused all HackerOne vulnerability reports for July 2026, citing a flood of AI-generated 'slop' reports. What this means for open source security triage.
P.51CISA added the SharePoint deserialization bug CVE-2026-45659 to its Known Exploited Vulnerabilities catalog on July 1, with a patch deadline of July 4. Here's who's affected, how the exploit works, and what to patch right now.
P.52OAuth handles authorization, OIDC adds identity on top of it, and SAML is the older enterprise SSO standard that still runs a lot of the corporate world. Here's how to pick the right one without reading three RFCs.
P.53Three maximum-severity UniFi OS flaws chain into unauthenticated root code execution and are being exploited in the wild by a Mirai-derived botnet. Here's what's affected, how the chain works, and how to patch it today.
P.54A command injection flaw in LiteLLM's MCP test endpoints, chained with a Starlette host-header bypass, lets an unauthenticated attacker run arbitrary commands on your AI gateway and steal every provider key behind it. Here's what's affected and how to patch.
P.55In May and June 2026, two separate supply chain attacks hit the npm ecosystem — TanStack (42 packages) and React Native Aria (17 packages). They used different entry points, had different payloads, and should change how every team handles third-party dependencies.
P.56Node.js pushed security updates on June 18, 2026 across v22, v24, and v26, patching 12 CVEs. Two are high-severity auth bypasses. The most interesting is undici's HTTP response queue poisoning, which can send the wrong response to the wrong request on keep-alive connections.
P.57CVE-2026-12048 is a CVSS 9.3 stored XSS in pgAdmin 4 that lets a malicious PostgreSQL server inject JavaScript into your browser tab. Every version from 6.0 to 9.15 is affected. The fix is v9.16.
P.58DevSecOps is a distinct discipline from DevOps and from security engineering. Here's what the role actually covers, what skills to screen for, and why supply chain security is now the core competency.
P.59June 2026 Patch Tuesday is the largest monthly security release of the year: 206 CVEs, 37 rated Critical, three publicly disclosed zero-days, and a Splunk Enterprise RCE that attackers started exploiting within days of disclosure. Here's what to patch first.
P.60Both tools keep your dependencies current automatically. Here is how they actually differ, where each one breaks down, and which to choose based on your team's setup.
P.61Security engineer is a sprawling category with genuinely different specializations. Here is how to define the role you actually need, run a screen that tests real skill, and avoid the common hiring mistakes.
P.62The OWASP API Security Top 10 lists the most critical API vulnerabilities. Most are fixable with straightforward code changes. This guide walks through each one with real examples.
P.63Vulnerability scanning catches known CVEs in your base images and dependencies before they reach production. Here's how to set up Trivy and Snyk, understand their output, and act on what they find.
P.64Most web apps are missing four or five headers that would neutralize entire classes of attack. Here's what each header does, what to set, and why most defaults leave you exposed.
P.65Three real authentication options for Next.js apps, with different trade-offs on control, cost, and setup time. Here's what each one actually involves.
P.66Employees are using AI tools IT hasn't approved, and the data leaving through those tools is largely invisible. Here's what the risk looks like and what actually helps.
P.67Tailscale creates a private mesh network across any combination of cloud servers, developer laptops, and office machines — without port forwarding, firewall rules, or dedicated VPN hardware.
P.68Row Level Security moves data isolation into the database where it belongs. Here's how to set it up for a multi-tenant SaaS, handle common edge cases, and avoid the traps that break it.
P.69When your AI agent needs to run the code it writes, you can't let it touch your production servers. Here's how the main isolation options work and when to use each.
P.70The implicit flow is dead, and most tutorials still teach it. Here is how authorization code flow with PKCE actually works, how tokens should be stored, and where most SPA auth implementations go wrong.
P.71From .env files to Vault to AWS Secrets Manager: a practical guide to storing credentials, API keys, and certificates without waking up to a breach notification.
P.72Leaked credentials are the most preventable category of security breach. Here is an honest look at when you need a dedicated secrets manager, which tool to pick, and what to do if you're still on .env files.
P.73Running containers in production without scanning them is the equivalent of shipping code without running tests. Here's how teams scan images, generate SBOMs, and add runtime protection, from the CI step to the cluster.
P.74Passkeys are no longer an experimental feature. Apple, Google, and Microsoft all support them natively. Here's what WebAuthn actually looks like in code and when passkeys make sense for your app.
P.75Prompt injection is the SQL injection of the AI era. As LLMs ship into production apps by the millions, attackers are learning how to hijack them through the data they consume. Here's what the attack looks like and how to defend against it.
P.76Explore ZeroDayBench—A new benchmark testing the efficacy of leading LLM agents in discovering and patching unseen security vulnerabilities.
P.77An honest analysis of Claude Code's security model, prompt injection risks, sandbox escapes, and supply chain threats in agentic coding tools. Lessons every developer and tool builder should learn in 2026.
P.78A comprehensive security briefing covering February 2026's most critical vulnerabilities including OpenSSL RCE, Foxit PDF Reader zero-days, Chrome V8 exploits, and Linux kernel privilege escalation.
P.79SOC 2 is not as scary as it sounds. Here is what engineering teams actually need to implement, the tools that automate 80% of it, and what to skip.
P.80NIST finalized post-quantum standards in 2024. Harvest-now-decrypt-later attacks are already happening. If your migration plan starts with 'we will deal with it when quantum computers arrive,' you are already behind.
P.81Supply chain attacks have surged 742% since 2019. SBOMs are now legally mandated for federal software and EU market access. Here is how to implement them without slowing down your CI/CD pipeline.
P.82EditorPickOkta warns of a critical 'authorization gap' where AI agents retrieve data with elevated permissions but post to shared spaces where anyone can see. Four major vendors already hit with CVSS 9.3+ vulnerabilities.
P.83A CVSS 10.0 remote code execution vulnerability in React Server Components has been actively exploited in the wild. Here's the full breakdown of React2Shell, the follow-up DoS CVE, patching guidance, and lessons for React developers.
P.84EditorPickA trademark dispute, crypto scammers, 100K GitHub stars, a social network for AI agents, and a security crisis — the Clawdbot saga has everything. Here's the full story of the viral AI assistant that broke the internet.
P.85EditorPickAI agents are being deployed everywhere, but their security surface is wildly underexplored. From tool poisoning to memory injection, here's the threat landscape developers must understand in 2026.
P.86From supply chain attacks to AI-powered threats, learn the essential security practices every developer must know in 2026 to build secure applications.