Daily Writeups
@Daily_Writeups
4.13K subscribers
4 photos
138K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.13K subscribers
Daily Writeups
⤷ Title: Software Security in 2026: A Practical Guide Every Developer Should Know
════════════════════════
𐀪 Author: Alamgir Hossen
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 13:23:07 GMT
════════════════════════
⌗ Tags: #software_development #programming #cybersecurity #web_development #application_security
Medium
Software Security in 2026: A Practical Guide Every Developer Should Know
From Secure Coding and Token Management to Cyberattacks, Prevention, and Incident Response
8 views
Daily Writeups
⤷ Title: Daybreak Blue goes nearly blind past 100,000 lines of code
════════════════════════
𐀪 Author: Jost Faganel
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 11:20:01 GMT
════════════════════════
⌗ Tags: #openai #devsecops #application_security #cybersecurity
Medium
Daybreak Blue goes nearly blind past 100,000 lines of code
On the benchmark it scores ~80%. On real systems over 100,000 lines, this top-ranked AI scanner found 10 bugs out of 565. If your codebase…
8 views
Daily Writeups
⤷ Title: Securing a payment API that external applications can call
════════════════════════
𐀪 Author: Altafhossain
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 09:26:57 GMT
════════════════════════
⌗ Tags: #application_security #fintech #api_security
Medium
Securing a payment API that external applications can call
The moment a payment API is called from an application outside your own system, the questions change.
10 views
Daily Writeups
⤷ Title: Indirect Prompt Injections Will Breach Your Database: Why LLM Tool Parameters Are Vulnerable to…
════════════════════════
𐀪 Author: Essam (8085.ai)
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 09:02:21 GMT
════════════════════════
⌗ Tags: #application_security #artificial_intelligence #cybersecurity #system_architecture #database_security
Medium
Indirect Prompt Injections Will Breach Your Database: Why LLM Tool Parameters Are Vulnerable to Injection Attacks and How to Engineer…
How untrusted input data manipulates model tool calls and the defensive application security architecture required to protect enterprise…
8 views
Daily Writeups
⤷ Title: Advanced Mobile Application Penetration Testing: Complete Lab Setup and Tools Guide
════════════════════════
𐀪 Author: nishant pawar
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 06:44:01 GMT
════════════════════════
⌗ Tags: #bug_bounty_tips #mobile_security_android #mobileapplicationpentest #application_security
Medium
Advanced Mobile Application Penetration Testing: Complete Lab Setup and Tools Guide
Mobile applications have become an essential part of modern digital services, including banking, e-commerce, healthcare, and enterprise…
10 views
Daily Writeups
⤷ Title: From P4 to P1 — Day 7: IDOR and Broken Object-Level Authorization (BOLA) in Bug Bounty Hunting
════════════════════════
𐀪 Author: cyb3rD1vvy@
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 06:00:00 GMT
════════════════════════
⌗ Tags: #ethical_hacking #cybersecurity #application_security #bug_bounty #web_applications
Medium
From P4 to P1 — Day 7: IDOR and Broken Object-Level Authorization (BOLA) in Bug Bounty Hunting
Series: From P4 to P1: The Bug Hunter’s Journey Day: 07/30 Topic: IDOR, BOLA, Access Control Testing, and Manual Validation
9 views
Daily Writeups
⤷ Title: Embedded Browsers in Five AI Development Tools Risk File Leaks: Codex and VS Code Remain Unpatched
════════════════════════
𐀪 Author: joho no todai
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 00:00:51 GMT
════════════════════════
⌗ Tags: #application_security #artificial_intelligence #cybersecurity #software_development #ai_agent
Medium
Embedded Browsers in Five AI Development Tools Risk File Leaks: Codex and VS Code Remain Unpatched
Embedded browsers in AI development tools were found capable of reading files on developers’ machines or triggering command execution…
12 views
Daily Writeups
⤷ Title: Your Android SDK API Key Is Not a Secret: Rethinking Client Authentication
════════════════════════
𐀪 Author: Hangga Aji Sayekti
════════════════════════
ⴵ Time: Thu, 29 Oct 2026 22:44:16 GMT
════════════════════════
⌗ Tags: #appsec #android #android_security #application_security #mobile_security
Medium
Your Android SDK API Key Is Not a Secret: Rethinking Client Authentication
How threat modeling reveals the limits of API keys in mobile SDKs — and how to design a safer authentication architecture.
10 views
Daily Writeups
⤷ Title: Node2Shell / HTTP2Shell: An October 2026 Brotli Exposure Map
════════════════════════
𐀪 Author: Saroyan Zorayr
════════════════════════
ⴵ Time: Thu, 29 Oct 2026 20:33:51 GMT
════════════════════════
⌗ Tags: #vulnerability_research #brotli #nodejs #application_security #cybersecurity
Medium
Node2Shell / HTTP2Shell: An October 2026 Brotli Exposure Map
30 October 2026 · A practical exposure map for CVE-2026–111497
11 views
Daily Writeups
⤷ Title: BOLA vs. BFLA: Understanding API Security Vulnerabilities Through Real-World Examples
════════════════════════
𐀪 Author: Dhrumil Soni
════════════════════════
ⴵ Time: Thu, 29 Oct 2026 11:49:48 GMT
════════════════════════
⌗ Tags: #cybersecurity #api_security #application_security #software_testing #owasp
Medium
BOLA vs. BFLA: Understanding API Security Vulnerabilities Through Real-World Examples
Change one ID in a URL and see someone else’s data. Here’s how to tell these two API authorization bugs apart, and how to test for both.
7 views
Daily Writeups
⤷ Title: JWT Authentication: Structure, Attacks, and Why Weak Signature Validation Gets You Pwned
════════════════════════
𐀪 Author: Muhammad Kashif
════════════════════════
ⴵ Time: Wed, 28 Oct 2026 21:09:35 GMT
════════════════════════
⌗ Tags: #cybersecurity #application_security #web_security #api_security #jwt
Medium
JWT Authentication: Structure, Attacks, and Why Weak Signature Validation Gets You Pwned
JSON Web Tokens (JWT) are the backbone of authentication in modern APIs, single page applications, and microservice architectures. They are…
8 views
Daily Writeups
⤷ Title: When Prompt Injection Becomes Code Execution
════════════════════════
𐀪 Author: Gilles Helleu
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 16:33:52 GMT
════════════════════════
⌗ Tags: #ai_agent #artificial_intelligence #application_security #software_development #cybersecurity
Medium
When Prompt Injection Becomes Code Execution
New research found attack chains from a text injection to RCE across seven AI platforms. OWASP 2026 says the pattern has a name.
20 views
Daily Writeups
⤷ Title: North Korean Hackers Target Developer Credentials to Poison GitHub Repositories and Software…
════════════════════════
𐀪 Author: Jas
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 17:39:27 GMT
════════════════════════
⌗ Tags: #developer_security #devsecops #threat_intelligence #application_security #north_korea
Medium
North Korean Hackers Target Developer Credentials to Poison GitHub Repositories and Software Packages
Software development environments have become an increasingly attractive target for sophisticated cybercriminal groups. A compromised…
18 views
Daily Writeups
⤷ Title: Authentication & Authorization Eğitim Serisi — Appendix C: OWASP Top 10 — Auth Context…
════════════════════════
𐀪 Author: Sahin Yelkenci
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 19:25:41 GMT
════════════════════════
⌗ Tags: #authentication #authorization #application_security #owasp_top_10 #cybersecurity
Medium
Authentication & Authorization Eğitim Serisi — Appendix C: OWASP Top 10 — Auth Context Cross-Reference
Ekler
38 views
Daily Writeups
⤷ Title: What Evidence Should an Application Security Program Produce?
════════════════════════
𐀪 Author: Arthur Steel | Contra Average
════════════════════════
ⴵ Time: Fri, 30 Oct 2026 23:13:57 GMT
════════════════════════
⌗ Tags: #cybersecurity #risk_management #application_security #software_development #compliance
Medium
What Evidence Should an Application Security Program Produce?
A scanner can tell you what it found. An accountable AppSec program should be able to show what was required, what was verified, and how…
32 views
Daily Writeups
⤷ Title: Semgrep and SonarQube found zero of 232 access-control bugs
════════════════════════
𐀪 Author: Jost Faganel
════════════════════════
ⴵ Time: Sat, 31 Oct 2026 10:41:10 GMT
════════════════════════
⌗ Tags: #cybersecurity #devsecops #infosec #application_security #sast
Medium
Semgrep and SonarQube found zero of 232 access-control bugs
Both scored 0% on the vulnerability class attackers chain most. If a rule-based scanner is your main control, your backlog records what it…
19 views
Daily Writeups
⤷ Title: CVE-2026–97229: CISA Confirms Active GitLab RCE Exploitation
════════════════════════
𐀪 Author: Logesh
════════════════════════
ⴵ Time: Sat, 31 Oct 2026 12:16:14 GMT
════════════════════════
⌗ Tags: #cicd #application_security #cybersecurity #devsecops #gitlab
Medium
CVE-2026–97229: CISA Confirms Active GitLab RCE Exploitation
October 31, 2026 | Cybersecurity | GitLab | DevSecOps | CI/CD Security
14 views
Daily Writeups
⤷ Title: AI × AppSec Hub — Edition 1
════════════════════════
𐀪 Author: Ujjwal Sinha
════════════════════════
ⴵ Time: Sat, 31 Oct 2026 14:34:46 GMT
════════════════════════
⌗ Tags: #application_security #bug_bounty #devsecops #cybersecurity #artificial_intelligence
Medium
AI × AppSec Hub — Edition 1
This week AI showed both sides of the AppSec story. AI-written code got measurably safer for the first time in a year. In the same week…
20 views
Daily Writeups
⤷ Title: Your AI Coding Assistant Will Run Whatever Its Config File Says
════════════════════════
𐀪 Author: Gopal Rajguru
════════════════════════
ⴵ Time: Sat, 31 Oct 2026 17:02:10 GMT
════════════════════════
⌗ Tags: #artificial_intelligence #cybersecurity #infosec #application_security #bugbounty_writeup
Medium
Your AI Coding Assistant Will Run Whatever Its Config File Says
[bug bounty hunters and appsec engineers] This month, a single trailing dot in GitHub Copilot’s own security prompt was turned into a…
23 views
Daily Writeups
⤷ Title: The Secure Code Review Challenge — Solution #8: Employee Directory (One Setting Away from Admin…
════════════════════════
𐀪 Author: Mohamed AboElKheir
════════════════════════
ⴵ Time: Sat, 31 Oct 2026 22:38:28 GMT
════════════════════════
⌗ Tags: #code_review #application_security #software_engineering #software_development #cybersecurity
Medium
The Secure Code Review Challenge — Solution #8: Employee Directory (One Setting Away from Admin Takeover)
Employee Directory does almost everything right. Invitation codes are random, hashed and single-use. JWTs have a pinned algorithm. Every…
23 views