12 posts
09 Sept 2026
How to roll out a Content Security Policy in Magento 2 without breaking the storefront, wire subresource integrity for third-party scripts, and the mistakes that make CSP cosmetic.
08 Sept 2026
A detailed breakdown of StyleSmuggler — an unauthenticated CVSS 10.0 RCE affecting every Magento Open Source and Adobe Commerce 2.4.4–2.4.9 — how it reaches live stores, and a step-by-step hardening and incident-response plan.
28 Jul 2026
Lock down a self-hosted Magento 2 store — isolate the admin, enforce 2FA, keep patches current, set correct permissions, and watch the usual attack surface.
10 Dec 2025
CVE-2025-59718 let attackers forge SSO logins into unpatched FortiOS as super-admin. Affected branches and lockdown steps.
04 Dec 2025
CVE-2025-55182 gave pre-auth RCE on React Server Components via a crafted payload. Affected packages, patches, and edge mitigations.
19 Jul 2025
CVE-2025-54309 let attackers gain CrushFTP admin via mishandled AS2 validation. Patch versions and exposure checklist.
18 Jun 2025
CVE-2025-5777, dubbed Citrix Bleed 2, leaks session memory from NetScaler gateways. Who is exposed and the hardening checklist.
14 May 2025
CVE-2025-4428 gave unauthenticated RCE on Ivanti Endpoint Manager Mobile. Patch chain, device-fleet risk, and what to check now.
25 Apr 2025
CVE-2025-31324 let unauthenticated attackers upload executables to SAP NetWeaver and get RCE. Why it was mass-exploited within days.
09 Apr 2025
Adobe's April 2025 Commerce update fixed authorization bypasses and CSRF across 2.4.4–2.4.8. What changed and how to upgrade safely.
22 Mar 2025
CVE-2025-29927 let attackers bypass Next.js middleware auth with a spoofed header. What broke, who is affected, and the patch checklist.
11 Mar 2025
CVE-2025-24813 turned Tomcat file writes into RCE via PUT and session persistence. Who is affected and how to patch fast.
Browse by topic: