Category
28 articles in Cybersecurity.
About this section
Security writing splits into two unhelpful piles: vendor content that ends in a product, and incident coverage that ends in alarm. What is missing is the middle, which is what a small engineering team should actually do on a Tuesday. That is what this section aims at. Breakdowns of real incidents with the part that matters to your codebase pulled out, compliance work described by someone who has been through the audit rather than sold it, and honest coverage of the new attack surface that AI tooling has opened, including in the tools we use ourselves. Where the responsible advice is that a risk does not apply to you at your size, we say that, because a checklist written for an enterprise is a good way for a five-person team to spend a month on the wrong thing.
All 28 articles
P.01SameSite cookies stop most CSRF, but not all. Learn when you still need tokens and Origin checks, with working Express code and a test you can run.
P.02Rotate a secret safely by provisioning the new value, running it alongside the old one, confirming every consumer, then revoking. Here's the runbook.
P.03PKCE stops a stolen OAuth code from being redeemed. It doesn't stop the wrong app from getting your redirect first. Here's the fix most mobile apps skip.
P.04A single unauthenticated request can run code inside OmniRoute, the 58k-star AI gateway. Patch status is contested, so verify your build yourself.
P.05MikroTik patched three RouterOS bugs after CISA confirmed active exploitation of two: which CVEs to prioritize and how to check your router for compromise.
P.06CVE-2026-75650 lets anyone run code on unpatched Magento and Adobe Commerce stores. Sansec found it deploying a Rust backdoor before Adobe even patched.
P.07CVE-2026-85046 is a Chrome V8 type confusion bug already exploited in the wild. Here's who's affected, what version fixes it, and how fast to move.
P.08CVE-2026-81934 is a use-after-free in Redis's TLS pending-data handling, with a public PoC. If you don't terminate TLS inside Redis, it mostly passes you by.
P.09A public proof-of-concept for a Windows Defender privilege-escalation flaw has circulated since August 12 with no fix shipped. What to do about it now.
P.10A capture-replay flaw in Tomcat's DIGEST authenticator lets an intercepted request be replayed once inside the nonce window. Critical, but narrow.
P.11Chrome 152 landed 327 security fixes, 10 of them critical use-after-free bugs in ANGLE, Views, and Safe Browsing. Why not-exploited isn't the same as safe.
P.12PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 fixed 28 CVEs on August 13, 17 of them CVSS 8.0 or higher. Which matter, and who's actually exposed.
P.13Two critical unauthenticated vCenter flaws let attackers skip login and run code on the management plane. What's affected, and how to check for compromise.
P.14A stack overflow in Windows DNS Server runs code from one crafted packet, no auth, no clicks. Not seen exploited yet, but shaped like a bug that will be.
P.15Only 8.5% of public MCP servers use OAuth, and a honeypot got hit within 48 hours. The checklist for auth, tool scoping, and input handling before you ship.
P.16The keyv attack poisoned 2,234 package versions in a day, and it won't be the last. The checklist for install scripts, provenance, lockfiles, and CI tokens.
P.17CISA added CVE-2025-68686, a FortiOS SSL-VPN symlink persistence bypass, on July 27. It only bites devices compromised earlier and never forensically cleaned.
P.18Red teaming means attacking your own prompts, retrieval pipeline, tools, and guardrails before a stranger does. The methodology, and tools that automate it.
P.19Trusted publishing lets GitHub Actions and GitLab CI publish via short-lived OIDC tokens instead of a stored npm token. The setup, and the May 2026 change.
P.20OAuth handles authorization, OIDC adds identity on top, and SAML is the older enterprise SSO standard still running much of the corporate world. How to pick.
P.21The OWASP API Security Top 10 catalogs the most exploited API vulnerabilities, from broken authorization to unsafe consumption, each fixable with targeted code.
P.22Vulnerability scanning catches known CVEs in your base images before they reach production. Here's how to set up Trivy and Snyk, read their output, and act on findings.
P.23Most web apps are missing four or five headers that would neutralize entire classes of attack. What each header does, what to set, and where defaults leave you exposed.
P.24Leaked credentials are the most preventable breach category. When you need a real secrets manager, which one to pick, and what to do if you're still on .env.
P.25Passkeys are mainstream now, with native support from Apple, Google, and Microsoft. Here's what WebAuthn looks like in real code, and when to use it.
P.26Prompt injection is the SQL injection of the AI era. Here's what the attack looks like, why it can't be patched, and how to actually defend against it.
P.27SOC 2 is a CPA's attestation report, not a certificate. The controls engineering teams implement, how Type 1 and Type 2 differ, and what audits typically cost.
P.28Supply chain attacks rose 742% since 2019, and SBOMs are now mandated for federal and EU software sales. Here's how to generate and manage them in CI/CD.