LiteLLM CVE-2026-42208 shows how a pre-auth SQL injection in an AI gateway can expose provider keys, routing data, and other secrets, turning LLM proxies into high-value credential vaults.
Fake Gemini CLI downloads and typosquatted npm packages are being used in active malware campaigns that target developers with reverse shells and fileless attacks on macOS and Windows.
A Linux kernel authencesn logic flaw in AF_ALG and splice() enables a deterministic 4-byte page cache write that can lead to root on major distributions and cross-container compromise.
A Windows RPC design flaw called PhantomRPC lets attackers abuse disabled or offline services to silently escalate standard service accounts to SYSTEM on patched Windows Server 2022 and 2025.
GitHub patched a critical remote code execution flaw in its internal git infrastructure within hours after Wiz Research used AI models to uncover a vulnerability that could expose millions of public and private repositories.
AI-assisted security research uncovered a critical remote code execution flaw in GitHub's internal git infrastructure, and GitHub patched it within hours after confirming no exploitation.
cPanel disclosed a critical authentication-path vulnerability affecting all supported versions and urged immediate updating after hosts like Namecheap temporarily blocked access to cPanel and WHM ports while patches were deployed.
CISA has ordered federal agencies to patch CVE-2026-32202, a zero-click NTLM hash leak in Windows that stems from an incomplete fix for CVE-2026-21510 and is already being abused in active attacks.
The Bitwarden CLI npm compromise briefly exposed users who installed @bitwarden/[email protected] during a narrow April 22, 2026 window and prompted immediate uninstall, cache cleanup, script hardening, and secret rotation steps.
Techniques and tools for detecting missing or weak postMessage origin validation in live web applications to prevent cross-origin attacks.
Vendor assessments go beyond checklists to evaluate the robustness of your product's security architecture and the maturity of your engineering and operational processes.
This post teaches techniques for testing CSV, PDF, and Excel export functions for permission bypass vulnerabilities.
This post explores methods for identifying and addressing obscure security flaws that can inadvertently enter codebases through AI-assisted contributions.
This post examines how attackers can exploit web storage mechanisms to hijack user sessions and provides auditing techniques to identify these vulnerabilities.
Learn how to systematically test workspace invitation features for common authorization vulnerabilities like privilege escalation and role bypass.
Learn how to test internal dashboards for authorization vulnerabilities using JavaScript techniques.
A practical guide to uncovering hidden bugs and security flaws in AI-generated code when you're reviewing applications you didn't author.
AI-generated authentication code inherits the same access control flaws as human-written code, but at a much faster development pace.
Learn practical strategies for spotting security bugs in unfamiliar codebases, even when you did not write the code yourself.
A practical guide to identifying and fixing security gaps in vibe-coded JavaScript before it reaches production.
An analysis of the common authorization mistakes found in AI-generated React code and how to avoid insecure access control patterns.
An audit of the security risks and common blind spots in AI-generated JavaScript, with practical guidance for identifying and reducing vulnerabilities.
An exploration of how blind trust in vibe coding and stack ignorance can create broken authorization vulnerabilities in software systems.
A practical look at how missing error boundaries and auth checks can turn vibe-coded features into production risks.