Dev.to Security

Smart Contract Vulnerability Surface Analysis: Base Bridge

Smart Contract Vulnerability Surface Analysis: Base Bridge Target Protocol: Base Bridge (TVL: $306…

Zip Slip and decompression bombs in Java: how to extract safely

Extracting an archive you did not create is a security boundary. Two attacks cross it with a few lin…

Securing Server Events in FiveM Scripts: A Short Checklist

Most money and item exploits on FiveM servers come from the same mistake: a script trusts the client…

Node.js Login Evidence — Beginner OTP 2FA Architecture with Email Fallback

A practical beginner design for a US/EU B2B SaaS product is to send the login code by SMS, verify it…

I Tried to Make My Own AI Agent Leak Its Secrets (and It Did)

I build things with LLMs, and I test things for a living, so sooner or later those two habits were g…

Slopsquatting: The Supply Chain Attack Your AI Coding Assistant Might Be Setting Up For You

You ask your AI assistant for a quick script. It writes clean code, imports a package you've never h…

Your device is not a browser

On 6 October 2026 Google said that attackers had compromised three country-code domain registries an…

How to Use AI for Smart Contract Audits in 2026 — 2026-10-07 #11

The landscape of blockchain security has shifted dramatically by 2026. Manual code reviews are no lo…

CVE-2026-104890: CVE-2026-104890: Remote Code Execution via Mixed-Case File Upload Bypass in Kunstmaan CMS MediaBundle

CVE-2026-104890: Remote Code Execution via Mixed-Case File Upload Bypass in Kunstmaan CMS MediaBundl…

Email Test Data Needs a Privacy Budget

Email fixtures are easy to treat as disposable. Create a temporary email address, trigger a signup o…

Gas Optimization Audit: Crypto-com

Gas Optimization Audit: Crypto-com Target Protocol: Crypto-com (TVL: $2499.1M) Crypto‑co…

Command Injection in Legacy CPE: A Technical Walkthrough of CVE-2026-95675

Command Injection in Legacy CPE: A Technical Walkthrough of CVE-2026-95675 Overview CVE…