» Tag
web-security
6 postsBeyond login: encrypting data with passkeys and WebAuthn PRF
WebAuthn's PRF extension turns passkey login into an encryption key source; pknotes shows a master-password-free, end-to-end encrypted architecture.
Pre-Auth SQL Injection in WordPress Core via Batch API Desync
Array desync in WordPress's REST batch API enables pre-auth SQL injection (CVE-2026-63030/60137); details plus a fast bitmask extraction technique.
Since Chrome 148, Math.tanh leaks the host OS at the bit level
Since Chrome 148, Math.tanh reads the host libm and leaks the real OS via trailing bits — a subtle new fingerprinting and spoofing-detection vector.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comHow ShareMyPage Safely Runs User-Uploaded JavaScript
ShareMyPage isolates uploaded HTML and JavaScript in a null-origin sandbox on a cookieless domain, blocking XSS and session hijacking without sanitizing code.
Half My Traffic Was Bots: A 4-Day Layered Defense Stack
A developer discovered headless bots executing JS made up half his traffic, then built a 4-day, five-layer defense using robots.txt, ISR, Redis, and Vercel BotID.
How a CORS Flaw Chains Into RCE on WordPress
Misconfigured CORS headers in WordPress plugins can chain with CSRF and file upload flaws into full RCE. A technical breakdown for bug bounty researchers.