Web Security

PHP2Shell Update: Exploitation Began Before Disclosure

AWS saw PHP2Shell attempts before disclosure. Here is what defenders now know about exploitation, memory disclosure, patch verification, and compromise hunting.

PHP's Emergency Security Release: What Determines Your Exposure?

PHP has patched CVE-2026-109618 and CVE-2026-109619. Understand confirmed attack paths, fixed versions, and the limits of temporary mitigations.

Drupal CVE-2026-108097: Field UI Turns Module Combinations Into an RCE Risk

Drupal fixed a critical Field UI remote-code-execution vulnerability that becomes exploitable through contributed modules or custom code. Identify exposed versions, update core, and investigate the application boundary before treating the patch as closure.

Meta’s New Commercial Terms: Your Business Website Becomes Part of the Deal

Meta’s October 30 commercial terms authorize broad website scraping for advertising and business products. What changed, what remains uncertain, and what businesses should review now.

Roundcube CVE-2026-48842: Check the Plugin, Patch the SQL Injection

A pre-authentication SQL injection in Roundcube's virtuser_query plugin has been reported in active use. Check whether your installation is exposed, update it, and investigate suspicious activity.

Agentic AI: The Enterprise Blind Spot That Attackers Already Found

Autonomous AI agents are already inside enterprise environments — and most security teams have no idea what they're doing. Here's what attackers exploit and how to defend against it.

Phishing Under the Microscope: Analyzing a Real Attack Email Step by Step

We tear apart a realistic phishing email using Security Decoder — headers, URLs, JWT tokens, and obfuscated JavaScript — and show exactly what each red flag means.

ownCloud CVE-2023-49105: The File Server Bug That Waited Three Years

CISA added an old ownCloud WebDAV authentication bypass to KEV after reported exploitation against Philippine research and defense-linked targets. The lesson is not novelty. It is exposed file infrastructure.

Homograph and Punycode Phishing: When a Domain Isn't What It Looks Like

A domain that looks pixel-perfect in your browser's address bar can still be fake. Here's how homograph and Punycode phishing exploits Unicode lookalike characters — and how to catch it.

KindaRails2Shell: When an Image Upload Reads Your Secrets

CVE-2026-66066 turns untrusted image uploads into file reads in Rails Active Storage. Check exposure, patch correctly, and rotate what leaked.

NGINX's Configuration-Dependent Vulnerabilities: Why Version Scanning Is Not Enough

NGINX 1.30.4 and 1.31.3 fixed three new memory-safety flaws, but exposure depends on map, slice, SSI, proxy, and buffering configuration. Here is how to audit the real path.

One Email Preview Is Enough: Russia's Half-Click Webmail Exploits

Russian-aligned espionage groups exploited stored XSS flaws in Zimbra, SOGo, Roundcube, MDaemon, and Kerio. Opening a message was enough to lose credentials, email, and persistent access.

CVE-2026-58644: The SharePoint Patch That Arrived With an Incident-Response Deadline

CISA says attackers are exploiting a critical SharePoint deserialization flaw. Patching closes the bug, but exposed servers also need a focused compromise assessment.

Prompt Injection in 2026: From Research Toy to Real CVEs, Agent Hijacking, and Zero-Click Exfiltration

CVE-2025-32711 (EchoLeak) exfiltrated M365 data with zero user interaction. The Anthropic MCP server had three exploitable injection CVEs. OpenAI says AI browsers may never be fully fixed. Here's the full attack chain — and how to detect it.

AI-Built Browser Ransomware Abuses Chrome File Access

Check Point analyzed a DeepSeek-attributed ransomware sample that should not work from a browser tab. Most of it was fiction — except for one detail that mapped to a real Chromium API. No malware install required.

RFC 10008: The New HTTP QUERY Method and the Attack Surface Still Catching Up

IETF published RFC 10008 in June 2026, standardizing the HTTP QUERY method. Here is where WAFs, caches, CORS handling, and CSRF assumptions need review.

One HTTP Header, Full Admin Access: Gitea's June 2026 Security Release Explained

Gitea 1.26.3 and 1.26.4 addressed a dense security release window, including a 9.8 CRITICAL auth bypass exploitable with a single HTTP header. Here's what broke and how to fix it.

Your Favicon Is Leaking Your Entire Infrastructure

A single 16x16 icon file can expose hundreds of servers, bypass WAF protections, and map your entire attack surface — here's how attackers use favicon hashing with Shodan, and how defenders can stop it.

47-Day Certificates Will Make Every Website Look Like a Phishing Site

The CA/Browser Forum is cutting TLS certificate lifespans from 398 to 47 days by 2029 to reduce the value of stolen certificates. The fix creates a bigger target: the automation that now issues every certificate on the internet.

You Are Now the Minority: Bots Have Officially Taken Over the Internet

2026 reports confirm bots now generate 53% of all internet traffic — the second year running that automated traffic outnumbers humans. Here's what that actually means.

SQL Injection 2026: Blind, Time-Based, ORM Bypass, and WAF Evasion

Still powering major breaches in 2026 — blind injection, time-based attacks, ORM bypasses, WAF evasion. Real payloads and detection queries.

CVE-2026-42897: Exchange Server Zero-Day Executes JavaScript Through Your Inbox

Microsoft's on-prem Exchange Server has an actively exploited XSS zero-day (CVSS 8.1). A single crafted email in OWA triggers arbitrary JavaScript — here's how it works and how to stop it.

API Security in 2026: JWT Attacks, OAuth Abuse, and GraphQL Exploitation

APIs are the most exploited attack surface in 2026. Learn how attackers abuse JWT tokens, OAuth flows, and GraphQL endpoints — and how to stop them.

Browser-in-the-Browser: The Phishing Attack That Fakes the Browser Itself

Browser-in-the-Browser (BitB) attacks forge convincing browser popup windows using pure HTML and CSS — making phishing pages nearly impossible to spot by eye. Here's how it works and how to defend against it.

CSRF Explained: How Attackers Trick Your Browser Into Making Requests for Them

CSRF (Cross-Site Request Forgery) forces authenticated users to unknowingly submit requests to a site they're logged into. Learn how it works, how to find it, and how to fix it.

IDOR Explained: How Attackers Access Anyone's Data by Changing a Number

IDOR (Insecure Direct Object Reference) is one of the most common and most impactful web vulnerabilities. Learn how it works, how to find it, and how to fix it.

Invisible Characters as an Attack Vector

Unicode's invisible characters are being weaponized — hiding malicious code in repositories, hijacking AI agents, and bypassing security reviews without leaving a trace visible to human eyes.

SSRF Explained: How Attackers Make Servers Fetch Secrets for Them

Server-Side Request Forgery (SSRF) lets attackers trick a server into making requests on their behalf — reaching internal systems, cloud credentials, and more.

Web Application Penetration Testing 2026: Beyond OWASP Top 10

Advanced web application security testing techniques covering modern frameworks, API exploitation, authentication bypass, and real-world attack scenarios for 2026

XSS Explained: How Attackers Inject Code Into Your Browser

Cross-Site Scripting (XSS) lets attackers inject malicious JavaScript into web pages viewed by other users — stealing sessions, redirecting victims, and taking over accounts.

Cookie-Controlled PHP Webshells: A Stealthy Tradecraft in Linux Hosting Environments

Microsoft's Defender team uncovered a clever attacker technique: PHP webshells that stay completely dormant until activated by a secret HTTP cookie. Here's how it works — and how to catch it.

Client-Side File Analysis with Directory Tool Pro

A Chrome extension for local file scanning and secrets detection. No cloud uploads, instant analysis, useful for security audits and pentesting workflows.