A Laravel link preview feature that leaks AWS credentials, why blocking private IP ranges still leaves you open (the same bypass worked on ByteDance), and how to prevent SSRF properly with DNS pinning, redirect validation and IP encoding checks.
Working out the undocumented file format behind New Outlook's local mail cache: Nostromo block headers, dual CRC-32 validation, LZ4 payloads, and the .NET tick timestamps that took three attempts to find.
Security research revealing multiple critical vulnerabilities in Faveo Helpdesk including RCE via hard-coded encryption keys, admin access control bypasses, and stored XSS.
Complete admin takeover vulnerability in Polr URL shortener exploiting PHP loose comparison and cookie manipulation to bypass authentication and gain full administrative access.
Learn how credential stuffing attacks work and discover practical defense strategies including MFA, CAPTCHAs, monitoring, and alerting to protect your applications from these common threats.
Discovering a critical supply chain vulnerability in Geoplugin.net's PHP API that leads to remote code execution through insecure deserialization in popular libraries.