Expert articles on web security, vulnerabilities, and best practices
NewsThe WP2Shell chain combines CVE-2026-60137 and CVE-2026-63030 to turn unauthenticated WordPress flaws into administrator creation and potential remote code execution. Real attack activity has been observed.
NewsCVE-2026-42012 can cause GnuTLS to fall back to Common Name checks for certain URI and SRV SAN certificates, potentially weakening certificate validation and enabling service spoofing or interception.
ProductLearn how to prepare for a Vulnify Automated Penetration Test by defining authorized scope, mapping third parties, preparing test credentials, reviewing evidence, and planning the included retest.
NewsCVE-2024-5971 is an Undertow denial-of-service flaw affecting a specific Java 17 and TLS 1.3 response-handling scenario. Teams should verify package versions, runtime conditions, and patch status.
ProductUse this post-incident website validation workflow after credentials, repositories, code, or administration access may have been compromised, with focused public checks and broader recovery guidance.
ProductFollow a practical Vulnify workflow from security finding to root-cause remediation, targeted retesting, broader validation, documented closure, and ongoing monitoring.
NewsCVE-2026-18072 tracks a deliberately introduced authentication backdoor in Advanced Responsive Video Embedder versions 10.8.7 and 10.8.8. The malicious code could grant unauthenticated attackers administrator access using a hardcoded token, making the incident a WordPress software supply-chain compromise rather than a conventional coding bug.
ProductLearn how to use Vulnify Website Watch without alert fatigue by establishing baselines, muting accepted findings deliberately, tuning thresholds, and connecting alerts to remediation.
SecurityLearn how CSRF works, when cookie-authenticated applications are exposed, and how tokens, SameSite cookies, Origin checks, reauthentication, and safe testing work together.
NewsCVE-2026-48595 affects the Elixir Tesla HTTP client when Tesla.Middleware.FollowRedirects is used. Case-sensitive filtering can fail to remove a normally cased Authorization header on a cross-origin redirect, potentially sending bearer tokens or other credentials to an attacker-controlled destination.