Technical Blog

March 30, 2023
CVE-2022-37734: graphql-java Denial-of-Service

March 17, 2023
From Zero to AppSec Anti-Hero: How AI Brings More Security Issues Than It Fixes

March 2, 2023
CocoaPods Subdomain Hijacked: This is How

February 21, 2023
How NPM Packages Were Used to Spread Phishing Links

February 14, 2023
Securing Open-Source Solutions: A Study of osTicket Vulnerabilities

February 1, 2023
Open Source vs Commercial AppSec Tools: Considerations for Enterprise

January 3, 2023
Exploiting GraphQL Query Depth

December 28, 2022
Alias and Directive Overloading in GraphQL

December 21, 2022
Didn’t Notice Your Rate Limiting: GraphQL Batching Attack

December 14, 2022
How 140k NuGet, NPM, and PyPi Packages Were Used to Spread Phishing Links

December 7, 2022
Move Over Verbose Error Messages, GraphQL APIs are Here

November 28, 2022
Attacker Uses a Popular TikTok Challenge to Lure Users Into Installing Malicious Package

November 28, 2022
What’s Old Becomes New Again: CSRF Attacks on GraphQL APIs

November 1, 2022
Analysis of OpenSSL CVE-2022-3786 and CVE-2022-3602

October 26, 2022
Attacking the Software Supply Chain with a Simple Rename

October 20, 2022
CVE-2022-42889: Text4shell Vulnerability Breakdown

October 7, 2022
LofyGang – Software Supply Chain Attackers; Organized, Persistent, and Operating for Over a Year

September 28, 2022
How We Created an API Security CTF

August 31, 2022
First Known Phishing Attack Against PyPi Users

August 26, 2022
Automatic Execution of Code Upon Package Download on Python Package Manager

August 22, 2022
Most Dangerous CWEs of 2021

August 18, 2022
Amazon Quickly Fixed a Vulnerability in Ring Android App That Could Expose Users’ Camera Recordings

August 17, 2022
Malicious PyPi User Strikes Again with Typosquatting, StarJacking and Unpacks Tailor-made Malware written in C#

August 14, 2022
Typosquatting Campaign Targeting Python’s Top Packages, Dropping GitHub Hosted Malware with DGA Capabilities

August 3, 2022
Large Scale Campaign Created Fake GitHub Projects Clones with Fake Commit Added Malware

July 15, 2022
Unverified Commits: Are You Unknowingly Trusting Attackers’ Code?

July 6, 2022
“CuteBoi” Detected Preparing a Large-Scale Crypto Mining Campaign on NPM Users

June 29, 2022
Amazon Confirmed and Fixed a High Severity Vulnerability of Broken Authentication in Amazon Photos Android App

June 27, 2022
Spring Function Cloud DoS (CVE-2022-22979) and Unintended Function Invocation

June 14, 2022
CVE-2021-33420: NPM Replicator Remote Code Execution Deserialization

June 8, 2022
New Technique Used by Attackers in NPM to Avoid Detection

May 27, 2022
GitHub RepoJacking Weakness Exploited in the Wild by Attackers

May 25, 2022
Attacker Caught Hijacking Packages Using Multiple Techniques to Steal AWS Credentials

April 26, 2022
Attacker Adds Evasive Technique to Their Ongoing Attacks on NPM

April 19, 2022
StarJacking – Making Your New Open Source Package Popular in a Snap

March 31, 2022
All You Need to Know about Spring Framework Vulnerabilities

March 31, 2022
New Protestware Found Lurking in Highly Popular NPM Package

March 31, 2022
SpringShell – Remote Code Execution via Spring Web

March 28, 2022
A Beautiful Factory for Malicious Packages

March 17, 2022
Protestware, Politics, and Open Source Software

March 7, 2022
Webhook Party – Malicious packages caught exfiltrating data via legit webhook services

February 24, 2022
Zenly Fixes User Data Exposure and Account Takeover Risks

February 8, 2022
Our Response to NPM Account Takeover Attacks – ChainAlert, a Community-Backed Open Source Tool

December 29, 2021
APACHE LOG4J RCE – Variants and Updates

December 28, 2021
CVE-2021-44832 – Apache Log4j 2.17.0 Arbitrary Code Execution via JDBCAppender DataSource Element

December 12, 2021
Apache Log4j Remote Code Execution – CVE-2021-44228

December 9, 2021
Recently Discovered Supply-chain Worm

November 16, 2021
A New Type of Supply Chain Attack Could Put Popular Admin Tools at Risk

November 4, 2021
Attackers Write Bugs as Well!

October 25, 2021
UAParser.js – Attack & Preparations

September 23, 2021
CVE-2021-37794: XSS to One-Click RCE in FileBrowser

August 19, 2021
CTparental Vulnerabilities Enabled Filter Bypassing

July 29, 2021
Chained RaspAP Vulnerabilities Grant Root Level Access

July 8, 2021
API Crash Course: Broken Object Level Authorization Found in Coursera

July 6, 2021
Rewriting Your History Using a Historical Vulnerability

June 16, 2021
CVE-2021-31800: How We Used Impacket to Hack Itself

June 14, 2021
CVE-2021-33829: Stored XSS Vulnerability Discovered in CKEditor4 Affects Widely-Used CMS

June 4, 2021
The 0xDABB of Doom: CVE-2021-25641

February 11, 2021
Assistance Required: XSS Vulnerability Discovered in Helpdesk Software Solution Deskpro

February 3, 2021
Exploitable Path – How to Solve a Static Analysis Nightmare

January 20, 2021
Software Composition Analysis: Why Exploitable Path Is Imperative

December 2, 2020
Drupal Core: Behind the Vulnerability

November 19, 2020
Drupal Core: Behind the Vulnerability

November 17, 2020
Apache Unomi CVE-2020-13942: RCE Vulnerabilities Discovered

August 24, 2020
Integrating Checkmarx Security Results within GitLab

August 19, 2020
Race Conditions Can Exist in Go

August 18, 2020
You Better Get Going with Go

July 8, 2020
Mutation Cross-Site Scripting (mXSS) Vulnerabilities Discovered in Mozilla-Bleach

June 18, 2020
It’s Time to Update Your Drupal Now!

May 13, 2020
Solidity Top 10 Common Issues

February 26, 2020
Checkmarx Research: Smart Vacuum Security Flaws May Leave Users Exposed

February 19, 2020
Checkmarx Research: Apache Dubbo 2.7.3 – Unauthenticated RCE via Deserialization of Untrusted Data (CVE-2019-17564)

February 5, 2020
Checkmarx Research: A Race Condition in Kubernetes

January 15, 2020
Checkmarx Research: Solidity and Smart Contracts from a Security Standpoint

January 6, 2020
Breaking Down the OWASP API Security Top 10 (Part 2)

November 6, 2019
Breaking Down the OWASP API Security Top 10 (Part 1)

October 24, 2019
NFC False Tag Vulnerability – CVE-2019-9295

August 7, 2019
LeapFrog LeapPad Ultimate Security Vulnerabilities

February 12, 2019
Your Lenovo Watch X Is Watching You & Sharing What It Learns

February 4, 2019
Your Smart Scale is Leaking More than Your Weight: Privacy Issues in IoT

December 20, 2018
Android WebView: Are Secure Coding Practices Being Followed?

May 7, 2018
Diving Deep into Regular Expression Denial of Service (ReDoS) in Go