New updates patch critical Spring security vulnerabilities, mitigating cross-site scripting and server-side request forgery risks across multiple versions.

Introduction

I upgraded a service to Spring Boot 4.1, switched on its new SSRF filter, and braced for the usual fallout — a global block rule shredding…

SQL injection has been a known vulnerability for 25 years, and we’re not making good progress at preventing it.

I Built a Secure Gateway for Free LLMs So My API Key Never Touches a Browser

BOLA/IDOR is the #1 API vulnerability on OWASP’s list. Most backend developers ship it constantly without knowing its name.

TL;DR Researcher Kirill Firsov disclosed a fastjson RCE on July 19, 2026. It affects fastjson 1.2.68 through 1.2.83 under stock default settings. Full technical details are public, and third parti…

The source leaked. Read it like an attacker, chain the flaws, and compromise the Spring Boot application.

TL;DR A critical FastJson RCE vulnerability, CVE-2026-16723, carries a CVSS score of 9.0. Full technical details and working proof-of-concept exploit code are now public. Imperva reports active ex…

Introduction

For years, Fastjson version 1.2.83 stood as the definitive bastion of security for the library’s legacy branch, yet a newly unearthed vulnerability has shattered this illusion. The critical …

The problem nobody talks aboutICLR 2025 IRIS Paper All Miss

Lately, I’ve been wanting to dive deeper into web vulnerabilities to truly understand how they arise in today’s modern web applications.

110,000 combined stars. Zero authorization findings from the industry-standard scanners. Here’s what a purpose-built tool found instead.

At a glance Actor or group Unidentified attackers Activity type Voice phishing via Microsoft Teams Targets or victims Over 150 employees across 10+ companies Scale Widespread corporate targeting L…

BFLA is what happens when the right user hits the wrong function. It rarely shows up in a tutorial, and it hides in exactly the endpoints…

Over the past year I worked through two internal security reviews on a production Spring Boot service, closing nine High-severity findings…

You add this while debugging:

Your application isn’t always slow. Sometimes your deployment pipeline is.

A Principal Engineer Design Paper for Spring Boot, OAuth2, Multi-Tenancy, Kubernetes, Supply Chain, and Security Operations