HTTP Request Smuggling: When Two Servers Disagree
Request smuggling begins when a proxy and back end parse a request differently. Learn the risk, warning signs, safe validation, and durable fixes.
Application Security
6 articles
Webhook Security: Signatures, Replay Attacks, and SSRF
Secure both sides of a webhook: verify genuine events, stop replay and duplicate processing, and prevent callback URLs from reaching internal systems.
Map Your Login Chain Before Attackers Do: A Practical Guide to Finding Workflow Gaps
A login screen is only one step in an identity workflow. Map every entry, recovery, session, and high-risk action path, then test where the server actually enforces the rules.
1.8 Million Android Apps Scanned for Secrets: Treat Every APK as Public
Anthropic says a suspected ShinyHunters affiliate scanned 1.8 million Android APKs for hardcoded secrets. The defensive lesson is architectural: anything shipped to a phone must be treated as recoverable.
KindaRails2Shell: When an Image Upload Reads Your Secrets
CVE-2026-66066 turns untrusted image uploads into file reads in Rails Active Storage. Check exposure, patch correctly, and rotate what leaked.
Langflow CVE-2026-9198: Auto-Login Was a Server Shell
Default Langflow deployments exposed a two-step path from no account to remote code execution. Learn how to patch, isolate, hunt, and rotate secrets.