Published work filed under Web & API Security.
One Brotli bug, two names: Node2Shell and HTTP2Shell (CVE-2026-111497). Fixed versions for Node.js, Bun and Python, version checks, patch order and stopgaps.
AWS saw a PHP2Shell attempt on 17 October, four days before PHP's fix. Here's how to check logs, processes and files on PHP-FPM, mod_php and shared hosting.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws. Fixed versions, update steps and interim mitigations.
One attacker pointed AI agents at 1,200+ sites and got into 100+ companies. Here's what the agents hunted for and how to close each door on your own site.
A user-agent string names the client on each HTTP request, but anyone can fake it. Here is how to read one, verify Googlebot, and what UA reduction changes.
DNS records tell the internet where a domain points. Here are A, AAAA, CNAME, MX, TXT, NS, SOA, CAA and PTR, with live examples and a short audit list.
URL encoding (percent-encoding) turns unsafe characters into %XX. Here is %20 vs +, UTF-8, double encoding, and why validators must decode once first.
A hash is a fixed-length fingerprint of data. Here is how MD5 and SHA-256 differ, why fast hashes are wrong for passwords, and what HMAC adds.
A JWT is a signed bundle of JSON claims. Here is how to read one, why decoding is not verifying, and how to check for the classic JWT security flaws.
What breaks on an OAuth or OIDC login: redirect matching, PKCE, state, and the Host header. What I check, and what I turn on. No exploit lab.
Hands-on masterclass on auditing and exploiting GraphQL API vulnerabilities (introspection bypasses, alias rate-limit bypasses, BOLA, depth DoS) with full runna…
