Tag
#web-security
3 posts
- News
PHP2Shell: the bug isn't in your app, it's in PHP itself
CVE-2026-109618 and CVE-2026-109619 open the door to unauthenticated RCE in the PHP runtime. Updating your CMS isn't enough; you need to patch the PHP binary on the server. - Penetration Testing
WAF Won't Save You: The Illusion Behind Firewalls and the Harsh Truths
Think your 'premium' WAF makes your web application invincible? Think again. Let's talk about why defense starts in the code, not at the perimeter. - Penetration Testing
What Happens When You Change Just One Digit? The Silent Scream of IDOR
A deep dive into why authorization flaws like IDOR and business logic errors remain the 'invisible' threats that automated scanners often miss, told through real-world Red Team experience.