When we build APIs, one thing that is really important, for security is rate limiting.

When a patch for a critical vulnerability drops in a library downloaded over 500 million times a week, you expect it to be bulletproof…

When a patch for a critical vulnerability drops in a library downloaded over 500 million times a week, you expect it to be bulletproof…

Bug hunting is rarely about running an automated scanner and waiting for a critical alert. More often than not, it’s about staring at a…

Bug hunting is rarely about running an automated scanner and waiting for a critical alert. More often than not, it’s about staring at a…

The Growing Threat Hidden Behind npm install

While reviewing my logs, I found a suspicious request flagged as exploit:gen/cve_2025_55182. Let’s break down what it actually does.

When the very system designed to monitor your application becomes the vector that takes it down.

Protect your servers with the latest Node.js security updates. Patch critical vulnerabilities like CVE-2026-48933 to secure your infrastructure today.

Four undici vulnerabilities (CVE-2026-6734, CVE-2026-9697) affect the Node.js HTTP client, which sees 133M weekly downloads. Update undici now.

Story

At a glance Actor: Unknown threat actor Activity type: Phishing and multi-stage intrusion Targets: Hospitality and hotel industry (Europe and Asia) Scale: Unspecified number of impacted organizati…

Mapping of OWASP ASVS requirements for auth, injection, CORS, business logic, request smuggling to real Express/Node examples, plus how to…

The Javascript ecosystem explained through Python. Learn how runtime, package manager and event loop impacts modern web security

Part 1 of my AppSec transformation series — auditing, exploiting, and rebuilding a 2022 inventory system from the ground up.

A breakdown of hashing versus encryption for developers who store customer passwords, with working TypeScript examples using bcrypt…