When a patch for a critical vulnerability drops in a library downloaded over 500 million times a week, you expect it to be bulletproof…

Bug hunting is rarely about running an automated scanner and waiting for a critical alert. More often than not, it’s about staring at a…

Bug hunting is rarely about running an automated scanner and waiting for a critical alert. More often than not, it’s about staring at a…

The Growing Threat Hidden Behind npm install

While reviewing my logs, I found a suspicious request flagged as exploit:gen/cve_2025_55182. Let’s break down what it actually does.

When the very system designed to monitor your application becomes the vector that takes it down.

Protect your servers with the latest Node.js security updates. Patch critical vulnerabilities like CVE-2026-48933 to secure your infrastructure today.

Four undici vulnerabilities (CVE-2026-6734, CVE-2026-9697) affect the Node.js HTTP client, which sees 133M weekly downloads. Update undici now.

Story

At a glance Actor: Unknown threat actor Activity type: Phishing and multi-stage intrusion Targets: Hospitality and hotel industry (Europe and Asia) Scale: Unspecified number of impacted organizati…

Mapping of OWASP ASVS requirements for auth, injection, CORS, business logic, request smuggling to real Express/Node examples, plus how to…

The Javascript ecosystem explained through Python. Learn how runtime, package manager and event loop impacts modern web security

Part 1 of my AppSec transformation series — auditing, exploiting, and rebuilding a 2022 inventory system from the ground up.

A breakdown of hashing versus encryption for developers who store customer passwords, with working TypeScript examples using bcrypt…

At a glance Malware family Node.js backdoor (tracked as “TonRAT” by some researchers) Threat actor Unattributed; no named group Target / victims Hospitality sector; hotel staff Deliver…

TL;DR Node.js shipped fixes for 11 vulnerabilities on 29 July 2026. Three are rated high severity, and the rest are medium or low. The updates cover the 26.x, 24.x, and 22.x release lines. No in-t…

Room: Do Not Disturb (https://tryhackme.com/room/hh-donotdisturb-84a45644) Platform: TryHackMe Difficulty: Medium Category: Boot2Root /…

Most Node.js apps have an auth middleware. You write a protect function, drop it on your routes and call it done. That works fine until you…

Use this repository as a reference guide throughout your software development life cycle, whether you are releasing a new build, applying a…