Practical application security research, vulnerability breakdowns, defensive principles, and hands-on lessons.
CVE-2026-64638 is a pre-authentication reflected XSS affecting the WordPress core login page in versions 6.4 through 7.0.2. This post explains the parser differential, the affected versions, the fix, the conditional RCE extension, and a hands-on reproduction lab.
WP2Shell is an unauthenticated remote code execution chain in WordPress core, combining CVE-2026-63030 and CVE-2026-60137. What it is, how to fix and detect it, and how to reproduce the full pre-auth RCE in a hands-on lab.
Security is having a moment: new tools can read code, find bugs, and even suggest fixes. Some people took that to mean cybersecurity is basically over. This is my take from the inside: what’s actually changing, what isn’t, and why security was never just a code problem.
More posts
This post is all about the “big ideas” behind secure systems, like least privilege and separation of duties. These principles are surprisingly simple but form the backbone of how we design systems to stay safe from attacks.
How do systems make sure the right people get in, and the wrong ones stay out? In this post, we’ll dig into authentication (proving who you are) and authorization (what you’re allowed to do). They’re simple ideas, but they have a massive impact on security.
The CIA triad isn’t just a catchy acronym. It’s the backbone of security. We’ll break down confidentiality, integrity, and availability, and see how they shape the way we think about protecting systems and data.
We cannot start a meaningful exploration of computer security without defining the subject itself. In this post, we'll talk about what security actually means.