Dev.to Security

5 smart contract bugs i still see in 2026 (and how to catch them)

5 smart contract bugs i still see in 2026 (and how to catch them) the boring bugs that keep draini…

Saylor Took the Classroom Offline for PHP2Shell

Saylor Academy did not discover a breach in a learner account. It found PHP under the classroom, and…

DigiD Went Dark on Purpose. Logius took DigiD, MijnOverheid, and Overheid.nl offline on 21 October. It was a precaution, not a confirmed intrusion.

The Dutch government did not wait to see if PHP2Shell was theoretical. It turned off the sites peopl…

Cygames Scheduled the Outage for the Patch, Then Moved It Earlier

Cygames did not bury the cause in "emergency maintenance." The posts named PHP. On 21 October the c…

Final Fantasy XIV Closed the Door, Not the World

Square Enix did not have to take Eorzea offline to take PHP offline. It stopped new logins. On 21 O…

Wikipedia Stayed Up. Toolforge Did Not.

The Wikimedia Foundation did not switch Wikipedia off and go home. It switched off the parts where i…

Pokémon Home Went Down With the PHP Patch

Pokémon did not get a neat single-paragraph post in the first wave of PHP2Shell coverage. It got a l…

OAuth Redirect Tests Need an Identity Boundary

OAuth tests often focus on the visible protocol steps: send the user to the authorization server, re…

Leaked API Keys in LLMs: How AI Agents Expose Secrets

TL;DR LLMs can reproduce real leaked keys: Using only API output access, researchers recovered D…

Locking files in the browser with Web Crypto: PBKDF2, HKDF, and 1 MiB AES-GCM records

I built a small web app called Clipboard Share. Devices on the same Wi-Fi network see each other aut…

A PHP Patch Is a Deployment Claim. Here Is How to Prove It.

A successful package update does not prove that your production requests reach a patched PHP runtime…

Open-Weight CTI-REALM: A New Path for Security Agents

What Is CTI-REALM? CTI-REALM is a framework designed for security applications where language-mode…