menu

Recent posts tagged security

Description for Tag: "security"

Practices and technologies aimed at protecting systems and data from threats.
Level UI • 19 hours • in Articles • 9 min read
An MCP server is not a new API. It is a thin layer over the one you already have
Somewhere in the last year, "do we need an MCP server?" joined the list of questions that arrive in a brief before anyone has said what the thing is for. It is usually framed as MCP vs API, as though the Model Context Protocol were a newer kind of AP...
post-cover-33074
  • ai
  • api
  • webdev
  • security
7 Reactions 7 Comments
DunimeTech • 9 hours • in Articles • 3 min read
There is no such thing as a digital arrest
Originally published on the Dunimehttps://dunime.com/insights/there-is-no-digital-arrest.html blog. How the video-call script works, why it keeps working, and the free government channels that report it. > “You are under digital arrest. Stay on vid...
  • cybersecurity
  • security
  • india
  • fraud
0 Reactions 0 Comments
DunimeTech • 9 hours • in Articles • 4 min read
Verify an Indian company before you pay it
Originally published on the Dunimehttps://dunime.com/insights/verify-an-indian-company-before-you-pay.html blog. Three free government lookups, MCA, GST and Udyam, and the mismatches that should stop a payment. > A new supplier wants an advance. A ...
  • cybersecurity
  • security
  • india
  • fintech
0 Reactions 0 Comments
DunimeTech • 9 hours • in Articles • 3 min read
A breach claim is trending? Ask three questions first
Originally published on the Dunimehttps://dunime.com/insights/breach-claim-three-questions.html blog. How an investigator separates a real disclosure from recycled data, and what an organisation should do in the first hours. > A breach is announced...
  • cybersecurity
  • security
  • india
  • privacy
0 Reactions 0 Comments
DunimeTech • 9 hours • in Articles • 4 min read
The invitation is an APK
Originally published on the Dunimehttps://dunime.com/insights/the-invitation-is-an-apk.html blog. How wedding cards and traffic challans became India's most personal malware, and what an investigation has to capture. > The file arrives from an uncl...
  • cybersecurity
  • security
  • india
  • android
0 Reactions 0 Comments
DunimeTech • 9 hours • in Articles • 5 min read
Lost money online? RBI's five-day rule from 2027
Originally published on the Dunimehttps://dunime.com/insights/rbi-five-day-rule-online-fraud.html blog. What the Reserve Bank's amended directions change for bank customers: who carries the loss, the five-day reporting window, and a one-time compens...
  • cybersecurity
  • security
  • india
  • fintech
0 Reactions 0 Comments
DunimeTech • 9 hours • in Articles • 4 min read
CERT-In's AI agent advisory: what to fix this week
Originally published on the Dunimehttps://dunime.com/insights/cert-in-ai-agents-advisory.html blog. Advisory CIAD-2026-0049 in plain words: how AI agents reached live Indian systems through exposed keys and open cloud roles, and the checks CERT-In w...
  • cybersecurity
  • ai
  • security
  • india
0 Reactions 0 Comments
DunimeTech • 9 hours • in Articles • 6 min read
PHP2Shell: patch PHP now, then check
Originally published on the Dunimehttps://dunime.com/insights/php2shell-patch-php-now.html blog. Two critical PHP flaws let an attacker run code on a web server without logging in. What changed on 21 October, which sites it touches, and what to do t...
  • php
  • security
  • cybersecurity
  • webdev
0 Reactions 0 Comments
ilia • 16 hours • in Articles • 20 min read
php2shell: two ways PHP corrupts its own memory, and why turning that into a shell is still hard
A single unauthenticated request can run code as your web worker on PHP before 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. The bug is real, the patch is out, and reliable exploitation outside a lab is far harder than the headlines suggest. This is the full an...
  • php
  • security
  • webdev
  • programming
0 Reactions 0 Comments
A.Talaat • 20 hours • in Articles • 2 min read
What Is Idempotency?
🚀 What Happens When Your API Receives the Same Request Twice? Imagine a customer clicks “Pay Now” twice because the page freezes. Or a payment gateway retries a request because it never received your response. 💥 Without proper protection, your app...
post-cover-33068
  • rails
  • ruby
  • performance
  • security
0 Reactions 0 Comments
Tom Smithverified • 16 hours • in Articles • 9 min read
Developer Weekly Briefing — October 30, 2026
Security dominated this week, but not in the usual way. Two active campaigns turned GitHub configuration files into attack surfaces. Researchers demonstrated that the built-in browsers inside AI coding tools can read your SSH keys. And at Oracle AI ...
post-cover-33104
  • agenticai
  • devsecops
  • github
  • localai
6 Reactions 3 Comments
CodeWithRomi • 1 day • in Articles • 6 min read
Tailscale 1.104.4 Patches Four SSH and Serve Bulletins: How to Remediate
Tailscale SSH is a popular feature in homelab setups because it lets you ditch traditional SSH key management entirely and lean on your Tailnet's identity model instead. That makes the recent security investigation and remediation update worth paying...
post-cover-33031
  • security
  • linux
  • homelab
  • tutorial
0 Reactions 0 Comments
Paritosh Khubchandani • 1 day • in Articles • 4 min read
Verifying Razorpay Payments: The Order ID You Shouldn't Trust
> TL;DR: A valid Razorpay signature proves the payment is real. It does not prove the payment belongs to the order you're about to mark as paid. Verify against the Razorpay order ID you stored on the server, never the one the client sends, and back i...
post-cover-33032
  • razorpay
  • payments
  • django
  • security
2 Reactions 1 Comments
EmmeKappa23 • 1 day • in Articles • 5 min read
The Guardian denied both commands. It never read either one.
An MCP tool with one argument, script. I asked the OWASP Agent Control Standard ACS reference Guardian to judge two calls: echo ciao and echo rm -rf /. It denied both, for the same reason: {"decision":"deny","reasoning":"mapping.yaml reads tool \"mc...
post-cover-32969
  • security
  • ai
  • owasp
  • llm
0 Reactions 1 Comments
BashSnippets • 1 day • in Articles • 1 min read
Finding the world-writable files on your server before someone else does
A world-writable file can be rewritten by every account on the machine — including the service account your web server runs as. Code executing as www-data through a compromised plugin doesn't need root: any chmod 777 you left behind during past debug...
  • bash
  • linux
  • security
  • sysadmin
0 Reactions 0 Comments
Alex • 1 day • in Articles • 12 min read
The Deepfake That Signed Off on $25 Million: A Teardown of the Arup CFO Video-Call Heist (Feb 2024)
> Originally published at vibeagentmaking.comhttps://vibeagentmaking.com/blog/the-deepfake-that-signed-off-on-25-million-a-teardown-of-the-arup-cfo-video-call-heist/. In January 2024 an Arup employee in Hong Kong made 15 transfers totalling HK$200 m...
  • deepfake
  • fraud
  • security
  • finance
2 Reactions 1 Comments
gerwin • 2 days • in Articles • 13 min read
Lock Your Inbox: Email 2FA, Passkeys and App Passwords
This article was originally published on the @fuck.it bloghttps://fuck.it/blog/email-2fa-passkeys-app-passwords and is republished here by the author. There is a quiet assumption sitting behind almost every account you own: that if you ever lose you...
post-cover-32844
  • email
  • cybersecurity
  • security
  • authentication
5 Reactions 2 Comments
Anas Sheikh • 2 days • in Articles • 4 min read
You Deleted the .env File From Git. Your Secrets Are Still Public.
You notice it during a code review: .env is in the repository. Your stomach drops. You run git rm .env, commit with the message "remove env file", push, and feel the relief of a problem solved. It is not solved. The file is gone from your latest com...
  • security
  • git
  • nextjs
  • webdev
0 Reactions 0 Comments
EmmeKappa23 • 3 days • in Articles • 5 min read
I made my portfolio site audit its own security headers, live, in front of you.
My portfolio has a section that runs curl -I on itself while you watch. Not a screenshot of headers I pasted in last year and forgot to update. The page fetches its own URL, reads the response headers off it, and prints each one ON or missing, right ...
post-cover-32700
  • security
  • webdev
  • astro
  • showdev
0 Reactions 0 Comments
EmmeKappa23 • 3 days • in Articles • 3 min read
The Guardian blocked the command. The agent told me how to go around it.
The Guardian denied the command. Then the model wrote this: > To print the string anyway, run ! echo rm -rf / in your prompt, which skips my tool calls and their hooks. That was Claude Code, running through an OWASP Agent Control Standard ACS Guard...
post-cover-32710
  • security
  • ai
  • owasp
  • llm
0 Reactions 2 Comments
ja.lourenco • 3 days • in Articles • 1 min read
TruffleHog Secret Scanner Automation
Context and Problem An AWS EKS Cluster was attacked, and its secrets were compromised. The Kubernetes Secrets were not encrypted, anyone who works with Kubernetes know they are only base64-encoded by defaulthttps://kubernetes.io/docs/concepts/confi...
post-cover-32727
  • devops
  • security
  • bash
  • kubernetes
2 Reactions 1 Comments
Page:
chevron_left
🔥 548 posts • 👩‍💻 222 active writers
✨ Want to write in this topic?
Share your learning. Get discovered. Build your profile.
Join CoderLegion
💡 Why developers use CoderLegion
Track learning • Share posts • Get ranked publicly
Create your profile