Tag
38 articles tagged #Cybersecurity.
P.01SameSite cookies stop most CSRF, but not all. Learn when you still need tokens and Origin checks, with working Express code and a test you can run.
P.02Rotate a secret safely by provisioning the new value, running it alongside the old one, confirming every consumer, then revoking. Here's the runbook.
P.03PKCE stops a stolen OAuth code from being redeemed. It doesn't stop the wrong app from getting your redirect first. Here's the fix most mobile apps skip.
P.04A single unauthenticated request can run code inside OmniRoute, the 58k-star AI gateway. Patch status is contested, so verify your build yourself.
P.05MikroTik patched three RouterOS bugs after CISA confirmed active exploitation of two: which CVEs to prioritize and how to check your router for compromise.
P.06CVE-2026-75650 lets anyone run code on unpatched Magento and Adobe Commerce stores. Sansec found it deploying a Rust backdoor before Adobe even patched.
P.07IBM's 2026 report puts the average breach at $4.99M. Pentests run $4K-$30K, IR retainers $25K-$150K a year. Patching early is the cheapest line item.
P.08CVE-2026-85046 is a Chrome V8 type confusion bug already exploited in the wild. Here's who's affected, what version fixes it, and how fast to move.
P.09CVE-2026-81934 is a use-after-free in Redis's TLS pending-data handling, with a public PoC. If you don't terminate TLS inside Redis, it mostly passes you by.
P.10A public proof-of-concept for a Windows Defender privilege-escalation flaw has circulated since August 12 with no fix shipped. What to do about it now.
P.11A capture-replay flaw in Tomcat's DIGEST authenticator lets an intercepted request be replayed once inside the nonce window. Critical, but narrow.
P.12Chrome 152 landed 327 security fixes, 10 of them critical use-after-free bugs in ANGLE, Views, and Safe Browsing. Why not-exploited isn't the same as safe.
P.13TEEs encrypt data even from the cloud provider running it, which is why confidential computing became a real AI requirement. What it does and doesn't cover.
P.14A Merkle tree proves a piece of data belongs to a large dataset, or finds exactly what changed between copies, without reading all of it. How, and where.
P.15PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 fixed 28 CVEs on August 13, 17 of them CVSS 8.0 or higher. Which matter, and who's actually exposed.
P.16cargo-audit finds known CVEs after the fact; cargo-vet checks trust before you upgrade. Setup for both, and which catches an arrayref-style attack.
P.17Two critical unauthenticated vCenter flaws let attackers skip login and run code on the management plane. What's affected, and how to check for compromise.
P.18A stack overflow in Windows DNS Server runs code from one crafted packet, no auth, no clicks. Not seen exploited yet, but shaped like a bug that will be.
P.19Only 8.5% of public MCP servers use OAuth, and a honeypot got hit within 48 hours. The checklist for auth, tool scoping, and input handling before you ship.
P.20The keyv attack poisoned 2,234 package versions in a day, and it won't be the last. The checklist for install scripts, provenance, lockfiles, and CI tokens.
P.21CISA added CVE-2025-68686, a FortiOS SSL-VPN symlink persistence bypass, on July 27. It only bites devices compromised earlier and never forensically cleaned.
P.22Red teaming means attacking your own prompts, retrieval pipeline, tools, and guardrails before a stranger does. The methodology, and tools that automate it.
P.23Agent sandbox escapes, prompt injection, and tool-permission design are a distinct skill set from AppSec. What to screen for, and where candidates come from.
P.24Vercel's first monthly Next.js security release shipped July 21 with 4 high and 5 medium advisories. What they cover, and why Server Actions keep appearing.
P.25North Korea-linked campaigns hide malware in take-home coding tests, using steganography in SVGs to pass review. How to vet a challenge before you run it.
P.26After a 13-CVE surprise release in May, Vercel moved Next.js to a monthly, pre-announced security cadence. What it promises, and how to plan upgrades.
P.27Trusted publishing lets GitHub Actions and GitLab CI publish via short-lived OIDC tokens instead of a stored npm token. The setup, and the May 2026 change.
P.28npm v12 blocks preinstall, install, and postinstall scripts, Git dependencies, and remote tarballs unless allowed. What breaks, and how to migrate.
P.29OAuth handles authorization, OIDC adds identity on top, and SAML is the older enterprise SSO standard still running much of the corporate world. How to pick.
P.30Security engineer covers five genuinely different jobs. How to define the one you need, run a screen that tests real skill, and dodge the usual mistakes.
P.31The OWASP API Security Top 10 catalogs the most exploited API vulnerabilities, from broken authorization to unsafe consumption, each fixable with targeted code.
P.32Vulnerability scanning catches known CVEs in your base images before they reach production. Here's how to set up Trivy and Snyk, read their output, and act on findings.
P.33Most web apps are missing four or five headers that would neutralize entire classes of attack. What each header does, what to set, and where defaults leave you exposed.
P.34Leaked credentials are the most preventable breach category. When you need a real secrets manager, which one to pick, and what to do if you're still on .env.
P.35Passkeys are mainstream now, with native support from Apple, Google, and Microsoft. Here's what WebAuthn looks like in real code, and when to use it.
P.36Prompt injection is the SQL injection of the AI era. Here's what the attack looks like, why it can't be patched, and how to actually defend against it.
P.37ZeroDayBench tested GPT-5.2, Claude Sonnet 4.5, and Grok 4.1 against 22 novel zero-day vulnerabilities. Here's why they failed to patch 73% of them, and what it means.
P.38Gartner predicts 1 in 4 job candidates will be fake by 2028. North Korean operatives have infiltrated 300+ US companies with AI personas. Here's how to defend hiring.