ddtcorex

Posts tagged “security”

12 posts

23 Oct 2026

Roundcube session desync (CVE-2026-114724): a '!' that turns into object injection

CVE-2026-114724 desyncs Roundcube session parsing with a '!' key into object injection. Patch 1.6.20/1.7.5 and check mail hosts.

securitycveroundcubephp

23 Oct 2026

Node.js Brotli RCE (CVE-2026-111497): malformed compression input to code execution

CVE-2026-111497 is an OOB write in Node's bundled Brotli decoder plus TLS bypasses. Upgrade to 22.23.4/24.22.1/26.12.1 now.

securitycvenodejsjavascript

23 Oct 2026

GitLab October release (12 CVEs): unauthenticated RCE via crafted compile input

GitLab's 22 Oct 2026 release fixes 12 CVEs including unauth RCE (CVE-2026-110264). Patch 19.3.6/19.4.3/19.5.1 now.

securitycvegitlabdevops

22 Oct 2026

PHPPresentation flaws (CVE-2026-114403/114404): a slide deck that runs code

PHPPresentation 1.2.0 deserializes objects from uploaded slide files plus a stored XSS. File-upload lessons for PHP apps.

securitycvephpdeserialization

22 Oct 2026

PHP core memory flaws (CVE-2026-109618/109619): when OOM handling corrupts the request

Two Oct 2026 PHP flaws corrupt request memory around OOM handling. Why every Magento host should track PHP patch releases.

securitycvephpinternals

22 Oct 2026

Duplicator plugin PHP Object Injection (CVE-2026-82814): migration input to code execution

CVE-2026-82814 gives unauthenticated PHP Object Injection via Duplicator's migration engine. The deserialization lesson for every PHP shop.

securitycvewordpressphp

10 Oct 2026

Integration tokens, OAuth, and the admin token you should not use

Compare admin, customer, and integration tokens, rotate secrets safely, and stop using the admin token for integrations

magento2apisecurity

30 Sept 2026

3-D Secure 2 and SCA flows in a Magento checkout

How Cardinal 3DS2 challenge and frictionless flows satisfy SCA inside a Magento checkout without killing conversion

magento2paymentssecurity

13 Sept 2026

Checkout fraud, payment abuse, and bot defenses in Magento 2

How to defend the revenue path: card-testing bots, stolen-card orders, scraping, and layering Magento's built-in tools with edge defenses so fraud costs stay predictable.

magento2securityfraudbotscheckout

12 Sept 2026

API and integration hardening in Magento 2

How to lock down Magento's REST/GraphQL and SOAP surfaces, scope integration tokens, rate-limit abusive callers, and stop the leaks that expose customer and order data.

magento2securityapigraphql

11 Sept 2026

Dependency supply-chain and CVE patching in Magento 2

How a Magento store's real attack surface is its dependency tree, how to track CVEs, patch safely, and avoid the two failures that leave stores exposed for months.

magento2securitydependenciescve

10 Sept 2026

Two-factor auth and admin access hardening in Magento 2

How to enforce 2FA on every admin account, lock down access by IP and role, rotate provider keys, and the admin-hardening steps that stop the most common breach path.

magento2securityadmin2fa

Browse by topic:

2faaccessibilityadminadobe-commercealpineanalyticsapiarchitectureauditb2bbest-practicesblueprintsbotscachecachingcatalogcheckoutcicicdcitrixclicomplianceconfigurationconsentcontentcore-web-vitalscrawlcrushftpcspcustomizationcvedatabasedebuggingdependenciesdeploydeploymentdeserializationdetectiondevopsdidockereavecommerceenterpriseerpeventsfile-transferfortinetfpcframeworksfraudfrontendgdprgitlabgogovardgraphqlhardeningheadlesshyvai18nimagesindexerintegrationinternalsinventoryivantijavajavascriptlaravellayered-navigationlayoutlcplocal-devmagento2migrationmodulesmonitoringmsimultistorenetworknextjsnodejsobservabilityonboardingopensearchorderspatchpaymentsperformancephppluginspricingprofilingpwaqualityrcereactredisremotesresilienceroundcubesapsearchsecurityseosessionsshippingslostructured-datasymfonysynctailwindteamtestingtomcatupgradevarnishwcagwordpressworkflowxdebugzeroday