Application Security

1.8 Million Android Apps Scanned for Secrets: Treat Every APK as Public

Anthropic says a suspected ShinyHunters affiliate scanned 1.8 million Android APKs for hardcoded secrets. The defensive lesson is architectural: anything shipped to a phone must be treated as recoverable.

KindaRails2Shell: When an Image Upload Reads Your Secrets

CVE-2026-66066 turns untrusted image uploads into file reads in Rails Active Storage. Check exposure, patch correctly, and rotate what leaked.

Langflow CVE-2026-9198: Auto-Login Was a Server Shell

Default Langflow deployments exposed a two-step path from no account to remote code execution. Learn how to patch, isolate, hunt, and rotate secrets.