Practical security insights for teams without a SOC

PHP2Shell is the name researchers gave to two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker run code on a server through ordinary web requests. The PHP team shipped fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your site runs PHP, which covers every WordPress, Joomla, […]

Command injection, usually referring to OS command injection, is a security vulnerability in which attacker-controlled input changes an operating-system command executed by an application, allowing unintended command behavior or additional commands to run with the application’s privileges, The core trust boundary is straightforward: the attacker influences data, the application turns that data into part of […]

An exposed .env file vulnerability occurs when a web server allows unauthorized users to retrieve an environment configuration file. A publicly accessible .env file can reveal database credentials, API keys, application secrets, cloud credentials, mail passwords, signing keys, and other configuration values that were intended to remain server-side.The severity depends on what the file contains […]

The OWASP API Top 10 is a ranked list of the ten most critical API security risks, and the 2023 edition is still the current version. It covers broken authorization, broken authentication, resource abuse, server-side request forgery, misconfiguration, and unsafe use of third-party APIs. This guide explains all ten risks with an attack example, a […]

The best vulnerability scanning tools in 2026 depend on what you need to scan. ScanTitan, Intruder, and HostedScan serve small teams that want cloud scanning without a security department, Tenable Nessus, Qualys VMDR, and Rapid7 InsightVM cover servers and networks, and Invicti, Burp Suite DAST, and Detectify test running web applications. This guide compares ten […]

An exposed backup files vulnerability occurs when a backup, database dump, old source-code copy, deployment archive, or editor-generated file is publicly accessible from a web server. Files such as config.php.bak, database.sql, site-backup.zip, or index.php~ can reveal source code, credentials, private data, and internal application details.The impact depends on what the backup contains. An obsolete static […]

XML External Entity (XXE) Injection is a web security vulnerability in which an application processes attacker-controlled XML with a parser that is allowed to resolve external entities or other external XML resources. That unsafe parser behavior can expose local files, trigger server-side requests to internal or external systems, or create other unintended resource access. The […]

A directory listing vulnerability occurs when a web server exposes a browsable index of files and subdirectories that were not intended to be discovered this way. Instead of returning an index page or denying access, the server generates a list that can reveal filenames, backup archives, configuration files, logs, source code, database exports, or internal […]

Insecure Direct Object Reference (IDOR) is an access control vulnerability in which an application uses a user-controllable reference to retrieve, change, delete, or otherwise act on an object without verifying that the requester is authorized to perform that action on that specific object.The central mistake is confusing authentication with authorization. Authentication answers “Who are you?” […]

WordPress user enumeration is the process of discovering information that identifies valid WordPress accounts, such as user IDs, display names, author slugs, author URLs, or whether an account exists. WordPress can expose some of this information intentionally through author pages, REST API responses, sitemaps, and login behavior. Enumeration does not bypass authentication and does not […]

A CORS misconfiguration occurs when a web application allows an untrusted origin to read cross-origin responses that should only be available to trusted websites. Common causes include reflecting arbitrary Origin values, weak origin validation, trusting null, or allowing origins that attackers can control.Not every permissive CORS response is an exploitable vulnerability. The real risk depends […]

Cross-Site Request Forgery (CSRF) is a web security vulnerability in which an attacker causes a user’s browser to send an unintended request to an application that accepts the user’s automatically supplied credentials or authority. The browser may be authenticated, but the application fails to verify that the user actually intended the action.That distinction is the […]