Cybersecurity

An allowed transform cannot hide an XPath

An allowed transform cannot hide an XPath A transform URI can look compatible while its stored par…

How a Base-Denom Collision Let Untrusted IBC Vouchers Drain ZIGChain's Native Reserves

IBC denom traces are part of an asset's identity. They record the route through which a token enter…

Qwen Code 0.21.5 MCP Safe Replay Checklist

Qwen Code 0.21.5: stop duplicate MCP writes after disconnects Quick answer Qwen Code 0.…

How to Build a Canary Token System for Breach Detection

Attackers who breach your systems rarely announce themselves. They move laterally, exfiltrate data q…

Why You Shouldn't Paste Private Logs Into Cloud Regex Testers 🔍

When debugging a complex regular expression—whether you're parsing user emails, server transaction l…

A package binding needs a real Reference

A package binding needs a real Reference A local URI such as #idPackageObject names an OPC package…

Broken Access Control in Laravel — Why Being Logged In Isn't Enough

This is the tenth article in a series on PHP and Laravel application security. So far we have cover…

HEVD: From Stack Overflows to Modern Pool Grooming

Hi. I just published a four-part deep dive into windows kernel exploitation, progressing from classi…

CVE-2026-18574: CVE-2026-18574: Authentication Bypass via Alternate Path in Check Point Security Management Server

CVE-2026-18574: Authentication Bypass via Alternate Path in Check Point Security Management Server …

A timestamp declaration needs its shape

A timestamp declaration needs its shape An OPC package signature carries a claimed signing time in…

CVE-2026-69198: CVE-2026-69198: Server-Side Request Forgery Bypass via CIDR Suffix in ip-address Library

CVE-2026-69198: Server-Side Request Forgery Bypass via CIDR Suffix in ip-address Library Vulnerab…

SQL injection, XSS, and buffer overflow look identical on Security+ until you find one detail

Domain 2 questions about application vulnerabilities have a shape that catches people out. The stem …