Security

Security

A technical breakdown of CVE-2026-44109, a CVSS 9.2 Critical authentication bypass vulnerability in OpenClaw (< 2026.4.15). Two fail-open logic inversions in the Feishu/Lark plugin — one in the webhook signature validator and one in the card-action replay guard — allow an unauthenticated attacker to inject arbitrary events into OpenClaw's command dispatch engine. When the bot has execution tools enabled, this translates directly to unauthenticated remote code execution on the host machine with the privileges of the OpenClaw process.

Security

A deep dive into a critical Server-Side Request Forgery (SSRF) vulnerability in Chatwoot's upload endpoint (≤ v4.12.1). The /api/v1/accounts/:id/upload endpoint accepts an external_url parameter validated only by a scheme check, allowing any authenticated agent to force the server to fetch arbitrary internal URLs. The full response body is returned in-band through ActiveStorage blobs — turning the upload endpoint into a full-read proxy. Live exploitation on a DigitalOcean droplet confirmed in-band exfiltration of cloud metadata including droplet ID, hostname, SSH public keys, and full metadata bundles. Fixed in v4.13.0.

Security

A DORA compliance checklist helps banking and fintech organizations evaluate operational resilience across core areas like ICT risk, incident response, resilience testing, third-party governance, and oversight, while tracking implementation progress and supporting audit readiness.

Security

Static analysis of TV_V_23.apk, BeatBanker/BTMOB Android banking malware disguised as a flashlight app: four-stage chain, anti-analysis, attribution and IOCs.

Security

How HarmonyOS Next security testing differs from Android: ArkTS, DSoftBus, testing tools, SafetyDetect, ArkGuard, common flaws and OWASP MASVS mapping.

Security

How intent redirection lets attackers reach unexported Android components, leak data via setResult() and abuse PendingIntents, plus six ways to prevent it.

Security

Mobile game security testing prevents cheating, hacks, and revenue loss by securing client, network, and backend layers. This guide covers the latest threats, testing methodologies, and best practices for mobile security teams and mobile game developers looking to keep their game safe, fair, and compliant.

Security

Mobile AppSec testing for teams shipping iOS and Android fast: MAST vs SAST vs DAST, a testing checklist, CI/CD patterns and severity-based release gating.

Security

How to security test patient portals, medical apps, APIs and SaMD: ePHI risks, HIPAA and GDPR duties, SDLC testing, continuous monitoring and incident response.

Security

Protecting mobile banking apps requires more than securing the client alone. This guide explores the risks across devices, networks, and backend systems, and explains why continuous mobile security testing is essential for protecting financial data and transactions.