Security

Security

A technical breakdown of DirtyFrag, a pair of Linux kernel local privilege escalation vulnerabilities (CVE-2026-43284 and CVE-2026-43500, CVSS 7.8 HIGH) that allow any unprivileged local user to obtain root on most major Linux distributions. By chaining an xfrm-ESP and an RxRPC in-place decryption path flaw, both rooted in the same page-cache write primitive as Dirty Pipe and Copy Fail, the exploit overwrites read-only page cache pages without a race condition, achieving near-100% reliability.

Security

A technical breakdown of CVE-2026-44109, a CVSS 9.2 Critical authentication bypass vulnerability in OpenClaw (< 2026.4.15). Two fail-open logic inversions in the Feishu/Lark plugin — one in the webhook signature validator and one in the card-action replay guard — allow an unauthenticated attacker to inject arbitrary events into OpenClaw's command dispatch engine. When the bot has execution tools enabled, this translates directly to unauthenticated remote code execution on the host machine with the privileges of the OpenClaw process.

Security

A deep dive into a critical Server-Side Request Forgery (SSRF) vulnerability in Chatwoot's upload endpoint (≤ v4.12.1). The /api/v1/accounts/:id/upload endpoint accepts an external_url parameter validated only by a scheme check, allowing any authenticated agent to force the server to fetch arbitrary internal URLs. The full response body is returned in-band through ActiveStorage blobs — turning the upload endpoint into a full-read proxy. Live exploitation on a DigitalOcean droplet confirmed in-band exfiltration of cloud metadata including droplet ID, hostname, SSH public keys, and full metadata bundles. Fixed in v4.13.0.

Security

A DORA compliance checklist helps banking and fintech organizations evaluate operational resilience across core areas like ICT risk, incident response, resilience testing, third-party governance, and oversight, while tracking implementation progress and supporting audit readiness.

Security

Static analysis of TV_V_23.apk, BeatBanker/BTMOB Android banking malware disguised as a flashlight app: four-stage chain, anti-analysis, attribution and IOCs.

Security

How HarmonyOS Next security testing differs from Android: ArkTS, DSoftBus, testing tools, SafetyDetect, ArkGuard, common flaws and OWASP MASVS mapping.

Security

How intent redirection lets attackers reach unexported Android components, leak data via setResult() and abuse PendingIntents, plus six ways to prevent it.

Security

Mobile game security testing stops cheating, bots and tampering across client, network and backend layers: threats, testing methods and best practices.

Security

Mobile AppSec testing for teams shipping iOS and Android fast: MAST vs SAST vs DAST, a testing checklist, CI/CD patterns and severity-based release gating.

Security

How to security test patient portals, medical apps, APIs and SaMD: ePHI risks, HIPAA and GDPR duties, SDLC testing, continuous monitoring and incident response.