Tag
Two severe vulnerabilities disclosed in PHP affect nearly 20 years of versions, knocking major sites like Wikipedia, WordPress-backed platforms, Internet Archive, and Cloudflare-protected services offline and forcing some old Japanese mobile games to permanently shut down.
CZ warns users to be cautious browsing the web after two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting WordPress and Magento servers were exploited in the wild following an early leak, prompting patches and WAF protections.
PHP 8.x 全系发布紧急安全更新，修复两个远程代码执行漏洞；因协调披露流程泄露导致 PoC 提前扩散，PHP Foundation 与 Wiz 公布了完整披露时间线。
Two critical PHP zero-day vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP 5.4 and later are being exploited in the wild, prompting an emergency PHP release and outages across countless sites, with OpenAI and Wiz involved in the research and disclosure.
紧急修复的两个关键 PHP 漏洞影响自 2004 年以来的所有版本，可能导致大规模远程控制攻击，促使全球政府和企业网站紧急下线并抢在攻击前打补丁。
Techaro 推出 BotStopper，一款基于 Anubis 开源理念打造的智能机器人防护产品，帮助企业阻挡恶意抓取与自动化滥用，同时保持良好的真人访客体验。
A blog post demonstrates another technique for invoking arbitrary JavaScript functions without parentheses by overwriting Error.prepareStackTrace with the Function constructor and controlling Array.prototype.toString, combined with prototype pollution and the valueOf trick to execute arbitrary code.
This article is a Cross-Site Scripting (XSS) cheat sheet providing various techniques and code examples for executing XSS attacks, along with browser compatibility information, sourced from PortSwigger.
The article discusses the challenges of blocking old browser user-agents to reduce crawler load and provides specific notes for feed readers and archival services affected by these measures.
A user reports encountering the Anubis bot protection screen with every click on Lobsters, suggesting a recent change that disrupts user experience.
DeCloudflare is a project hosted on GitLab that provides tools to bypass or interact with Cloudflare services.
Research article from PortSwigger demonstrating new XSS attack vectors using JavaScript properties in HTML tag names, enabling WAF bypasses across browsers.
AliExpress was found using inaudible sounds for browser fingerprinting, a technique that browsers like Firefox have fixed through library changes. The article discusses the use of multiple tracking methods and the ongoing privacy battle between websites and browser developers.
GlassBox is a client-side browser tool that reveals what data websites can collect about you through fingerprinting, running mostly locally to demonstrate privacy implications.
A simple URL using public certificate data can list all subdomains of a primary domain without any installation or setup.
A security researcher details the process of remotely unlocking electric scooters by performing reconnaissance on the company's web infrastructure and exploiting vulnerabilities in WordPress and an operations panel.
JSEF v1.10.0 is a model-agnostic LLM evaluation toolchain released with 20+ new hard vulnerability samples, designed for assessing LLMs in Java and web security contexts.
The article discusses using scroll behavior patterns to detect scraper bots by analyzing burstiness and memory metrics from human activity, improving on previous timing-based methods.
Security researcher James Kettle presented findings at Black Hat showing that while agentic AI is limited in autonomously devising novel hacks, it becomes a powerful partner when guided by humans, leading to the discovery of a new vulnerability class called Shared-Parser Confusion.
Eric Lawrence critiques Cloudflare's new Wallet signup flow, noting how it closely resembles consent phishing attacks, illustrating why web security is difficult.