https://uphack.io/blog/ Practical AppSec research, secure engineering lessons, exploit breakdowns, and security career advice. en-gb Mon, 14 Sep 2026 00:00:00 GMT https://uphack.io/blog/post/web-application-architectures/ https://uphack.io/blog/post/web-application-architectures/ Mon, 14 Sep 2026 00:00:00 GMT Now that we have a basic understanding of web application architecture, it’s time to dig deeper. As you probably noticed, not all web applications work the same. Some are faster... https://uphack.io/blog/post/client-vs-server-side/ https://uphack.io/blog/post/client-vs-server-side/ Fri, 11 Sep 2026 00:00:00 GMT The architecture of any web application, whether it’s facebook.com or some no-name Wordpress blog, starts with two components: frontend and backend. In this post, we will analyse these components, how they interact, and what each one is for. https://uphack.io/blog/post/idor-sso-investment-account-closure/ https://uphack.io/blog/post/idor-sso-investment-account-closure/ Thu, 10 Sep 2026 00:00:00 GMT How different password and SSO confirmation paths expose an IDOR in an investment account closure endpoint, including the request comparison, vulnerable code, impact, and ownership fix. https://uphack.io/blog/post/hashing-in-cryptography/ https://uphack.io/blog/post/hashing-in-cryptography/ Mon, 07 Sep 2026 00:00:00 GMT Hashing is everywhere in security, and for good reason. It’s how we verify data integrity, secure passwords, and much more. In this post, we’ll unpack what makes hashing so useful and see it in action. https://uphack.io/blog/post/symmetric-vs-assymetric-encryption/ https://uphack.io/blog/post/symmetric-vs-assymetric-encryption/ Sun, 06 Sep 2026 00:00:00 GMT Ever wonder how encryption actually works? Here, we’ll look at the two main approaches: symmetric, which is fast and straightforward, and asymmetric, which is a bit slower but incredibly powerful for secure communication. https://uphack.io/blog/post/introduction-to-cryptography/ https://uphack.io/blog/post/introduction-to-cryptography/ Fri, 04 Sep 2026 00:00:00 GMT Cryptography can feel intimidating, but don’t worry—we’ll keep it straightforward. This post is about understanding the basics: how we use cryptography to protect data and why it’s such a key part of security. https://uphack.io/blog/post/what-is-a-server/ https://uphack.io/blog/post/what-is-a-server/ Thu, 03 Sep 2026 00:00:00 GMT Not surprisingly, people tend to misuse the terms “server” and “web server”. Let’s settle once and for all what the difference between them is. https://uphack.io/blog/post/what-are-web-applications/ https://uphack.io/blog/post/what-are-web-applications/ Tue, 01 Sep 2026 00:00:00 GMT Web applications are everywhere, but what exactly are they? In this post, we’ll break down what makes a web app tick, how it differs from other types of software, and why it’s such a powerful tool in today’s connected world. https://uphack.io/blog/post/the-hugging-face-incident-is-not-an-ai-story/ https://uphack.io/blog/post/the-hugging-face-incident-is-not-an-ai-story/ Mon, 31 Aug 2026 00:00:00 GMT A security engineer’s analysis of the OpenAI-Hugging Face incident, what failed in the architecture and incident response, and the lessons security teams can learn from it. https://uphack.io/blog/post/reflected-xss-nested-newsletter-parameters/ https://uphack.io/blog/post/reflected-xss-nested-newsletter-parameters/ Tue, 25 Aug 2026 00:00:00 GMT How a nested digest[email] parameter becomes autofocus and onfocus attributes in a newsletter signup, including the payload, vulnerable code and fix. https://uphack.io/blog/post/base64-idor-return-credit-claim/ https://uphack.io/blog/post/base64-idor-return-credit-claim/ Wed, 19 Aug 2026 00:00:00 GMT How a Base64-encoded return reference leads to IDOR in a financial action: the request, decoded JSON, modified payload, vulnerable code, impact, and correct ownership check. https://uphack.io/blog/post/xss2shell-wordpress-login-xss/ https://uphack.io/blog/post/xss2shell-wordpress-login-xss/ Sat, 08 Aug 2026 00:00:00 GMT CVE-2026-64638 is a pre-authentication reflected XSS affecting the WordPress core login page in versions 6.4 through 7.0.2. This post explains the parser differential, the affected versions, the fix, the conditional RCE extension, and a hands-on reproduction lab. https://uphack.io/blog/post/wp2shell-unauthenticated-wordpress-core-rce/ https://uphack.io/blog/post/wp2shell-unauthenticated-wordpress-core-rce/ Fri, 24 Jul 2026 00:00:00 GMT WP2Shell is an unauthenticated remote code execution chain in WordPress core, combining CVE-2026-63030 and CVE-2026-60137. What it is, how to fix and detect it, and how to reproduce the full pre-auth RCE in a hands-on lab. https://uphack.io/blog/post/fundamental-security-principles/ https://uphack.io/blog/post/fundamental-security-principles/ Sun, 15 Mar 2026 00:00:00 GMT This post is all about the “big ideas” behind secure systems, like least privilege and separation of duties. These principles are surprisingly simple but form the backbone of how we design systems to stay safe from attacks. https://uphack.io/blog/post/you-are-the-bottleneck-now/ https://uphack.io/blog/post/you-are-the-bottleneck-now/ Sat, 14 Mar 2026 00:00:00 GMT AI can generate code faster than most developers can evaluate it. The risk isn't only bad output. It's losing the understanding you need to tell good code from plausible code. https://uphack.io/blog/post/the-illusion-of-building/ https://uphack.io/blog/post/the-illusion-of-building/ Sun, 01 Mar 2026 00:00:00 GMT AI makes it dramatically cheaper to produce software that appears to work. But 'building an app' and 'engineering a system' are two different activities that people keep confusing, and the gap between them is where most of the actual work lives. https://uphack.io/blog/post/security-is-not-a-code-problem/ https://uphack.io/blog/post/security-is-not-a-code-problem/ Sun, 22 Feb 2026 00:00:00 GMT Security is having a moment: new tools can read code, find bugs, and even suggest fixes. Some people took that to mean cybersecurity is basically over. This is my take from the inside: what’s actually changing, what isn’t, and why security was never just a code problem. https://uphack.io/blog/post/access-control-authentication-and-authorization/ https://uphack.io/blog/post/access-control-authentication-and-authorization/ Sat, 21 Feb 2026 00:00:00 GMT How do systems make sure the right people get in, and the wrong ones stay out? In this post, we’ll dig into authentication (proving who you are) and authorization (what you’re allowed to do). They’re simple ideas, but they have a massive impact on security. https://uphack.io/blog/post/foundations-of-information-security-cia-triad/ https://uphack.io/blog/post/foundations-of-information-security-cia-triad/ Sun, 15 Feb 2026 00:00:00 GMT The CIA triad isn’t just a catchy acronym. It’s the backbone of security. We’ll break down confidentiality, integrity, and availability, and see how they shape the way we think about protecting systems and data.  https://uphack.io/blog/post/introduction-to-information-security/ https://uphack.io/blog/post/introduction-to-information-security/ Sat, 14 Feb 2026 00:00:00 GMT We cannot start a meaningful exploration of computer security without defining the subject itself. In this post, we'll talk about what security actually means. https://uphack.io/blog/post/how-to-start-your-offensive-security-career/ https://uphack.io/blog/post/how-to-start-your-offensive-security-career/ Sun, 09 Mar 2025 00:00:00 GMT Is hacking like in the movies? How do I start? What do I need to know? What skills should I have? These are...