When I started learning web application security, I used to focus mainly on solving individual vulnerabilities.

by bhavesh khaire

Developers often confuse obscurity with security. A common anti-pattern is taking an incremental identifier (like user ID 1, 2, 3) and…

Difficulty: medium

Website filtering can be enforced at four points in a request's lifecycle. What each layer sees, what routes around it, and why network filters miss traffic.

TL;DR The Argo CD project has fixed four critical security flaws, each rated 9.9 on CVSS. Three of these Argo CD vulnerabilities let a user run commands or read files inside the argocd-repo-server…

TL;DR The Apache Software Foundation has patched two Apache Jackrabbit vulnerabilities in its WebDAV components. The worst, CVE-2026-92414, scores 9.3 on CVSS 4.0 and lets an attacker hijack a cac…

TL;DR Gitea has shipped 27 security fixes across versions 28.0.0 and 28.1.0. This Gitea security update closes server-side request forgery (SSRF) paths, an installer bug that grants admin sessions…

At a Glance Malware family PHP web shells, a Perl web shell installer, Platypus agents, and a Python reverse shell Threat actor Four unnamed clusters; one uses a tool tied to China-nexus actors (s…

PortSwigger: Unprotected admin, Unpredictable URL ve User role controlled by request parameter.

PortSwigger: Unprotected admin, Unpredictable URL ve User role controlled by request parameter.

This story was written with the assistance of an AI writing program, then reviewed, edited and fact-checked by me.

La inyección SQL aparece cuando una aplicación mezcla datos externos con la estructura de una consulta sin separar correctamente ambas…

Bir DNS adresi nasıl oluyor da PlayStation 5'in işletim sistemine kadar uzanan bir exploit zincirinin başlangıç noktası olabiliyor?

In this lab, we will analyze lab 1–3 from Practical Malware Analysis book. The goal is to examine the malware sample Lab01–03.exe using…

Linux File Search and Text Matching

Piecing together Linux evidence to uncover what ran, where it ran, how it started and what it left behind.

Indroduction :

October 7, 2026