TL;DR The PHP team will ship a security release on October 21, 2026, at 14:00 UTC to fix two critical flaws rated CVSS v4.0 9.2. Leaks tie them to CVE-2026-109618 and CVE-2026-109619, described as…

Submission volume is still growing, but validity has recovered sharply. High-severity findings are increasing; repeat researchers are returning. The community is not simply producing more, but it is learning how to produce better.

The retrospective rule changes and mass spam closures did not just dismiss valid technical findings — they inflicted severe collateral…

A hands-on guide to historical scan analysis, domain relationships, URL discovery, and smarter OSINT workflows.

The thinking behind each find, not just the payloads.

Nineteen findings in a regulated health application. Eighteen were work. One made me walk around the block before writing it up.

AI can build a working web app surprisingly fast. The interesting part begins when you stop asking whether the code works and start asking…

I thought I understood how websites worked until I stopped looking at the page and started looking at the requests behind it.

A practical guide to understanding, testing, and fixing path traversal vulnerabilities

A finding-by-finding ledger for verifying evidence, fix scope, re-testing, and optional PR dispositions before Copilot security suggestions…

Can a single unpatched web page bring down a company’s customer trust overnight? In 2015, UK telecom provider TalkTalk found out the hard…

Investigating suspicious activity, unexpected external links, and hidden SEO spam in a WordPress website.

After testing security tools, I realized that a few small Python scripts could automate the repetitive work I kept doing by hand.

We have seen this movie before, and it never gets less uncomfortable.

Security remains one of the biggest challenges facing cryptocurrency exchanges. As trading platforms handle significant volumes of digital…

Most vulnerability programs are overwhelmed by findings and have little ability to prioritize beyond the CVSS score. In this post I…

And the report is 70% of the job.

Scenario: John Doe is accused of illegal activity, and a disk image of his laptop was taken. You analyze the image to work out what…

Introduction

A technical deep-dive into DNS Tunneling the technique that hides stolen data, reverse shells, and entire C2 channels inside the one…

Introduction