Web App

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what to do now about your PHP

Two critical flaws in the PHP core allow unauthenticated RCE and memory disclosure. Fixed versions, mitigations, secret rotation and an ordered checklist.

php2shell: how LFI, upload and filter chains turn into RCE in PHP

Defensive guide to php2shell: how LFI, insecure upload, phar and PHP filter chains turn into RCE, real CVEs and public tools to validate and fix.

What is penetration testing? How it works and the types (black, grey and white box)

A complete guide to penetration testing: definition, phases, types by knowledge level (black, grey, white box) and by target, what a good report contains and how…

Why indie hackers, solopreneurs and vibe coders need a pentest

You shipped in weeks with AI writing the code, Stripe at checkout and auth out of the box. The catch: the flaws that sink small SaaS…

JWT and OAuth: the seven authentication mistakes that open the door without breaking the crypto

It's almost never the cryptography that fails — it's how the token is validated, where it's stored and what the OAuth flow trusts. The seven broken-authentication…

Scanner, pentest or bug bounty? What each one finds, what each one costs, and when to combine them

The three approaches don't compete — they cover different risks. A straight guide to deciding where to put your offensive security budget, with what each actually…

10 questions to ask before hiring a pentest (and the answers that disqualify a vendor)

Pentest proposals look identical on paper and range from $5k to $60k. These ten questions separate manual testing from a scanner with a logo, and keep…