Blog Posts

Ed25519 vs ECDSA: Why the Nonce Decides Everything

TryHackMe : Infinity Pool Writeup

Building Anti-Phishing Features - Lessons from StashPatrick

Your file upload validation is probably lying to you.

How I Prevent unauthorized user to access restricted routes

How to Detect Cross-Tenant Data Leakage in MCP Servers and Multi-Tenant SaaS

What a Malicious Ollama Model Can Actually Do to Your Host, and How to Sandbox /api/pull

Sanitizers Don't Flatter Anyone: Scoring Free Coding Models on C++ Undefined Behavior Fixes

Day 6: DNS Resolution, Load Balancers, Firewalls & Networking Protocols

UNC6671: Helpdesk Vishing, SSO and SaaS Cross-Traversal, and Multi-Brand Extortion via Notification Deletion

Paperclip CVE-2026-41679: 6 API Calls from Public Registration to AI Agent Host Process RCE

TONTOU: Linux Kernel Leak via Timer Interrupt Stealing After Spectre v2 Defense Neutralization

TeamCity CVE-2026-63077: Unauthenticated Deserialization RCE in Agent Polling Actively Exploited

They scoped the customer and forgot the customer's ledger — a High-severity cross-tenant BOLA in Open Food Network

GHSA-RVMM-V933-JGXQ: GHSA-rvmm-v933-jgxq: Missing Authorization Check in Craft CMS ChartsController

A database credential is not rotated until the old one fails

GHSA-957R-QF9P-67XW: GHSA-957R-QF9P-67XW: Arbitrary File Read via SplFileObject in Craft CMS Twig Extension

Build a Secrets Manager with Python and Encryption

My Scanner Missed 93% of the Bugs — and That Was the Right First Result

I blocked XSS attacks and API Key extraction in the browser by monkey-patching `crypto.subtle`. Why isn't everyone doing this?

7 JWT Security Mistakes I See in Almost Every Auth Implementation

Zbtlink Ships ENDLESSDOORS: 21 Firmware Images, One Unauthenticated Root Shell

Common Cryptographic Anti-Patterns to Avoid in Modern APIs

Reducing False Positives in AppSec Triage with Paraconsistent Logic (LPA2v)