sast

S Stefan Mitocaru · Sep 1, 2026 · 19 min

CVE-2026-78174: how an unredacted session token in a diagnostic log turned a low-privileged WatchGuard Dimension admin into super admin

Inside CVE-2026-78174: WatchGuard Dimension writes Super Administrator session tokens into a diagnostic log any lower-privileged Administrat...

S Stefan Mitocaru · Aug 3, 2026 · 18 min

CVE-2026-65321: how one backslash in PyAthena's quote escaper turned parameterized DELETE queries into SQL injection

Inside CVE-2026-65321: PyAthena sent DELETE and CTAS statements through a Hive escaper that backslash-escapes quotes, but Athena and Trino i...

S Stefan Mitocaru · Jul 31, 2026 · 19 min

CVE-2026-63223: how a GIF header on a PHP file turned CodeIgniter's image upload check into remote code execution

CodeIgniter's is_image and mime_in upload rules trusted content-derived MIME type but never the client filename extension, letting a .php fi...

P Paraschivoiu Alexandru · Jul 20, 2026 · 21 min

CVE-2026-60137 + CVE-2026-63030: how a one-position array desync in WordPress's batch API turned a login-only SQL injection into unauthenticated RCE

Inside wp2shell (CVE-2026-60137 + CVE-2026-63030): a REST batch route desync in WordPress core unblocks an author__not_in SQL injection, cha...

P Paraschivoiu Alexandru · Jul 17, 2026 · 19 min

CVE-2026-58644: how one unsafe deserialize turns an on-prem SharePoint server into unauthenticated remote code execution

Inside CVE-2026-58644: a critical (CVSS 9.8) deserialization flaw in on-premises Microsoft SharePoint Server that hands unauthenticated atta...

P Paraschivoiu Alexandru · Jul 6, 2026 · 18 min

Pragma Core for Dynamic AppSec Teams

Pragma Core for dynamic AppSec teams: how a continuous, AI-driven platform spanning code, infrastructure, and adversary emulation replaces t...

P Paraschivoiu Alexandru · Jul 2, 2026 · 18 min

CVE-2025-29927: how one internal header let attackers walk straight past Next.js middleware auth

Inside CVE-2025-29927: a forged x-middleware-subrequest header makes Next.js skip its own middleware, bypassing every authentication and aut...

P Paraschivoiu Alexandru · Jun 26, 2026 · 19 min

When the attacker has an AI too: AppSec scanning in an era where exploits arrive before patches

Inside the AI-offense era: autonomous systems like XBOW, Big Sleep, and Claude Mythos find and weaponize flaws in hours, while 28.3% of CVEs...

P Paraschivoiu Alexandru · Jun 24, 2026 · 21 min

Classic SAST vs AI-powered SAST: why pattern matching stops at the function boundary and reasoning takes over

Inside the SAST shift: why rule-based static analysis drowns teams in false positives and misses logic bugs, how AI-powered SAST reasons abo...

P Paraschivoiu Alexandru · Jun 3, 2026 · 18 min

CVE-2026-45659: how an ordinary site member turns on-prem SharePoint into a remote code execution box

Inside CVE-2026-45659: an insecure-deserialization (CWE-502) flaw lets any authenticated SharePoint Server Site Member run code on-prem (CVS...

P Paraschivoiu Alexandru · Jun 2, 2026 · 17 min

CVE-2026-48095: how a 1-byte heap buffer turned 7-Zip's NTFS parser into an extension-agnostic code execution primitive

Inside CVE-2026-48095: an undefined-behavior shift in 7-Zip's NTFS handler allocates a 1-byte buffer, then writes 256 MB into it, corrupting...

S Stefan Mitocaru · May 22, 2026 · 19 min

CVE-2026-43640: how one `&&` short-circuit turned a stolen Bitwarden session into a persistent SCIM key

Inside CVE-2026-43640: the C# short-circuit boolean that lets any authenticated Bitwarden admin with a stolen session pull or rotate the org...