Tag
48 articles tagged #Security.
P.01Next.js 15 stops getting security patches on October 21, 2026. Here is the upgrade path to 16: codemods, the breaking changes that bite, and a safe rollout.
P.02SameSite cookies stop most CSRF, but not all. Learn when you still need tokens and Origin checks, with working Express code and a test you can run.
P.03A practical RBAC pattern for Node.js and Postgres: roles, permissions, a middleware that checks both, and the traps that turn clean RBAC into unmaintainable spaghetti.
P.04Rotate a secret safely by provisioning the new value, running it alongside the old one, confirming every consumer, then revoking. Here's the runbook.
P.05Guardrails AI validates structured output, NeMo Guardrails controls dialog flow, and Llama Guard classifies safety. Here is which one fits your LLM app.
P.06MikroTik patched three RouterOS bugs after CISA confirmed active exploitation of two: which CVEs to prioritize and how to check your router for compromise.
P.07CVE-2026-75650 lets anyone run code on unpatched Magento and Adobe Commerce stores. Sansec found it deploying a Rust backdoor before Adobe even patched.
P.08Abliteration.ai sells API access to open-weight AI models with safety refusals surgically removed, and the buyer inherits every future flaw.
P.09IBM's 2026 report puts the average breach at $4.99M. Pentests run $4K-$30K, IR retainers $25K-$150K a year. Patching early is the cheapest line item.
P.10CVE-2026-85046 is a Chrome V8 type confusion bug already exploited in the wild. Here's who's affected, what version fixes it, and how fast to move.
P.11CVE-2026-81934 is a use-after-free in Redis's TLS pending-data handling, with a public PoC. If you don't terminate TLS inside Redis, it mostly passes you by.
P.12A public proof-of-concept for a Windows Defender privilege-escalation flaw has circulated since August 12 with no fix shipped. What to do about it now.
P.13A capture-replay flaw in Tomcat's DIGEST authenticator lets an intercepted request be replayed once inside the nonce window. Critical, but narrow.
P.14Chrome 152 landed 327 security fixes, 10 of them critical use-after-free bugs in ANGLE, Views, and Safe Browsing. Why not-exploited isn't the same as safe.
P.15TEEs encrypt data even from the cloud provider running it, which is why confidential computing became a real AI requirement. What it does and doesn't cover.
P.16cargo-audit finds known CVEs after the fact; cargo-vet checks trust before you upgrade. Setup for both, and which catches an arrayref-style attack.
P.17Prepared statements and parameterized queries stop SQL injection, as the OWASP cheat sheet says. Where ORMs quietly reintroduce it, and how to check your code.
P.18Two critical unauthenticated vCenter flaws let attackers skip login and run code on the management plane. What's affected, and how to check for compromise.
P.19A stack overflow in Windows DNS Server runs code from one crafted packet, no auth, no clicks. Not seen exploited yet, but shaped like a bug that will be.
P.20CISA added CVE-2025-68686, a FortiOS SSL-VPN symlink persistence bypass, on July 27. It only bites devices compromised earlier and never forensically cleaned.
P.21OAuth 2.1 is still an IETF draft, but most providers enforce it already. What changed from 2.0, plus a checklist for auditing your own implementation.
P.22No Access-Control-Allow-Origin is the most Googled web error for a reason. What CORS is, why the browser enforces it, and how to configure it properly.
P.23Red teaming means attacking your own prompts, retrieval pipeline, tools, and guardrails before a stranger does. The methodology, and tools that automate it.
P.24Vercel's first monthly Next.js security release shipped July 21 with 4 high and 5 medium advisories. What they cover, and why Server Actions keep appearing.
P.25After a 13-CVE surprise release in May, Vercel moved Next.js to a monthly, pre-announced security cadence. What it promises, and how to plan upgrades.
P.26Trusted publishing lets GitHub Actions and GitLab CI publish via short-lived OIDC tokens instead of a stored npm token. The setup, and the May 2026 change.
P.27npm v12 blocks preinstall, install, and postinstall scripts, Git dependencies, and remote tarballs unless allowed. What breaks, and how to migrate.
P.28Deno Sandbox spins up isolated Firecracker microVMs in under 200ms for running code you don't trust, AI-agent output included. Here's how it works and a working example.
P.29OAuth handles authorization, OIDC adds identity on top, and SAML is the older enterprise SSO standard still running much of the corporate world. How to pick.
P.30DevSecOps is distinct from DevOps and from security engineering. What the role covers, what to screen for, and why supply chain security is now the core.
P.31Both tools keep your dependencies current automatically. Here is how they actually differ, where each one breaks down, and which to choose based on your team's setup.
P.32Security engineer covers five genuinely different jobs. How to define the one you need, run a screen that tests real skill, and dodge the usual mistakes.
P.33The OWASP API Security Top 10 catalogs the most exploited API vulnerabilities, from broken authorization to unsafe consumption, each fixable with targeted code.
P.34Vulnerability scanning catches known CVEs in your base images before they reach production. Here's how to set up Trivy and Snyk, read their output, and act on findings.
P.35Most web apps are missing four or five headers that would neutralize entire classes of attack. What each header does, what to set, and where defaults leave you exposed.
P.36Three real authentication options for Next.js apps, with different trade-offs on control, cost, and setup time. Here's what each one actually involves.
P.37Tailscale is a mesh VPN giving distributed teams private networking between laptops, servers, and office machines in about 30 seconds, no VPN hardware needed.
P.38Row Level Security moves tenant isolation into the database itself. How to set it up for a multi-tenant SaaS, handle the edge cases, and avoid the traps that break it.
P.39When your AI agent needs to run the code it writes, you can't let it touch your production servers. Here's how the main isolation options work and when to use each.
P.40The implicit flow is dead and tutorials still teach it. How authorization code flow with PKCE works, where tokens belong, and where SPA auth goes wrong.
P.41From .env files to Vault to AWS Secrets Manager: a practical guide to storing credentials, API keys, and certificates without waking up to a breach notification.
P.42Leaked credentials are the most preventable breach category. When you need a real secrets manager, which one to pick, and what to do if you're still on .env.
P.43Passkeys are mainstream now, with native support from Apple, Google, and Microsoft. Here's what WebAuthn looks like in real code, and when to use it.
P.44Prompt injection is the SQL injection of the AI era. Here's what the attack looks like, why it can't be patched, and how to actually defend against it.
P.45ZeroDayBench tested GPT-5.2, Claude Sonnet 4.5, and Grok 4.1 against 22 novel zero-day vulnerabilities. Here's why they failed to patch 73% of them, and what it means.
P.46Astro's stable CSP hashes its scripts and styles into a per-page meta tag, with no nonces. How to set up security.csp in Astro 6 and 7, and where it stops.
P.47SOC 2 is a CPA's attestation report, not a certificate. The controls engineering teams implement, how Type 1 and Type 2 differ, and what audits typically cost.
P.48Supply chain attacks rose 742% since 2019, and SBOMs are now mandated for federal and EU software sales. Here's how to generate and manage them in CI/CD.