Securing the code you ship: XSS, SQL injection, SSRF, auth flaws, and the bugs attackers actually use.
Two critical PHP flaws landed October 21 and were in CISA's exploited-vulnerabilities catalog five days later. The 9.2 score isn't the part that should bother you. It's where the bug lives — it goes off while PHP is still assembling $_POST, before a single line of your application has run.
Eight eMudhra intermediate CA keys turned out to be recoverable from their own public certificates. Not stolen — computable, because the key generation produced almost no entropy. A researcher pulled all eight in under a second and signed a message with each one to prove it.
A pull request checkout, a poisoned GitHub Actions cache, and an OIDC token pulled straight out of runner memory. That's how 84 malicious versions of TanStack's packages hit npm in six minutes.
CVE-2026-41940 is a CVSS 9.8 authentication bypass in cPanel/WHM affecting every version after 11.40. It was a zero-day for two months, 44,000 IPs are now scanning, ransomware has deployed, and a state-linked actor is hitting Southeast Asian government networks. Patch now.
Most JavaScript developers never call an RSA function directly. They verify an RS256 token, and two classic attacks turn that into an authentication bypass — both demonstrated here, both fixed by one line.
Authentication is a cornerstone of contemporary applications. Virtually every app demands user login, identity verification, and secure sessions. Though it's ubiquitous, many developers implement authentication without
Vercel confirmed a security breach on April 18-19, 2026, tracing back to a compromised third-party AI tool and a single employee's Google Workspace connection. Here is the full attack chain, what was actually exposed, and what you need to do right now.
Every time you click "Sign in with Google" or "Connect your GitHub account," you are using OAuth. You have used it hundreds of times.
CVE-2026-33032, dubbed MCPwn, is a CVSS 9.8 authentication bypass in nginx-ui's MCP integration that lets any attacker on the internet restart your Nginx server, rewrite your configs, and intercept all traffic -- in two HTTP requests, no credentials required. Roughly 2,700 instances are exposed.
A critical SSRF flaw in Axios was used in a North Korean supply chain attack. Here's what it does and how to patch it today.
SSRF tricks your server into making requests to internal systems — cloud metadata services, internal APIs, AWS credentials endpoints. It turned a WAF misconfiguration into 100 million stolen Capital One records
Your application is only as secure as every package it depends on. In September 2025, attackers compromised 27 npm packages with 2.6 billion weekly downloads by phishing one maintainer.
