Three separate CVSS 10.0 sandbox escapes landed days apart — in a library that was declared dead once already

Building a REST API is only one part of exposing a service to consumers. Once an API is used by multiple applications or users, additional…

Building a Red vs Blue Cyber Range for Cookies Reuse and MFA Bypass A practical write-up on designing the attack story, building the lab, validating the result, and making the evidence visible. I …

Here’s a sentence that should sound impossible: sharing a link to a website could let someone run code on that website’s server. Not…

TL;DR: A path traversal vulnerability in the npm package image-downloader (< 4.3.1, ~38,000 downloads/month) lets an attacker write files…

Finding and Fixing Broken Access Control: A Case Study on Unauthenticated Admin Pages

An unexpected security incident in a Node.js project taught me why we should never blindly trust scripts loaded from external sources.

Not every file our upload endpoint accepts deserves the same treatment.

Build live chat, notifications, dashboards, tracking systems, collaborative features, and other real-time experiences using React, Node.js…

TL;DR On October 21, 2026, the Node.js project shipped versions 22.23.4, 24.22.1 and 26.12.1 to fix 10 vulnerabilities. This Node.js security release patches four high-severity flaws, including a …