TL;DR On October 23, 2026, the PHP team disclosed CVE-2026-115560, a new PHP session vulnerability tied to session upload progress. It can lead to remote code execution, but only in a rare setup. …

A CDN and your app can read the exact same URL two different ways. That tiny disagreement is enough to hand one user’s session token to a…

OWASP Top 10 Explained with Lab Examples

Disclaimer: This write-up is for educational purposes only. All attacks are done on PortSwigger’s Web Security Academy labs, which are made…

PHP2Shell: Web’in %69'unu Etkileyen Kritik PHP Açıkları (CVE-2026–109618 & 109619) Evet arkadaşlar yaklaşık 2 gün önce karşımıza PHP2Shell adında çok geniş kapsamlı ve çok …

# El Bandito — TryHackMe Writeup

I recently finished a security assessment of a multi-tenant SaaS platform with an integrated LLM assistant. Final rating: Critical. 17…

When I started learning cybersecurity, I assumed that completing a beginner learning path would mean learning everything from scratch.

How shared sessions, authentication mechanisms, and weak tenant isolation can expose one customer’s environment to another.

Modül II — Klasik Authentication