Tech watch
← All linksProtecting applications and infrastructure through vulnerability analysis, controls and defensive practices.
This skill turns a coding agent into a security auditor by orchestrating a six-phase repository audit, from reconnaissance to report generation. Findings are structured as machine-readable data and independently verified.
A separate agent tries to disprove each candidate; results distinguish confirmed findings, leads needing validation, and rejected candidates. Running target code requires an OS-enforced sandbox with external networking disabled and resource limits in place.
The four Fetch Metadata headers tell servers where a request came from and how its response will be used. Andrew Lock explains Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User to help distinguish, for example, a legitimate navigation from a suspicious cross-site request.
Examples contrast an image loaded from a CDN with a JavaScript fetch() call. Because JavaScript cannot modify these signals, servers can use them in a Resource Isolation Policy as an additional layer of defense against CSRF requests.
Andrew LockFound via C# Digest
This first installment presents a shared-schema .NET multi-tenant design: EF Core filters reads by tenant, while SQL Server physically partitions rows to speed up data access. The key distinction is that partitioning is not a security boundary; isolation relies on the EF Core global query filter.
The article also explains resolving the tenant per request, assigning its ID to new rows, and adding partitions to migrations with raw SQL. The primary key must include GuildId, a constraint SQL Server imposes when partitioning a unique index.
BarretFound via C# Digest
A remote code execution flaw in WordPress Core can let an unauthenticated attacker run code during a full-package update if the temporary directory is web-accessible. Wordfence says it blocked 62,969 attempts in 24 hours; a fix is available in version 7.1.4.
The attack hinges on racing cleanup: installer files are unpacked to a predictable path under wp-content/upgrade, and attackers are repeatedly probing files such as setup-config.php to catch the exposure window, which may last only seconds. The flaw affects versions 4.7 through 7.1.3.
The Hacker News
CVEngine brings continuous asset discovery, vulnerability scanning, and matching against exploited CVEs into a self-hosted platform. It aims to prioritize flaws that actually apply, using read-only validation and evidence rather than presenting only a list of alerts.
Version 1.3 adds Sentinels to run scans from private networks, along with an OpenVAS integration that is disabled by default. Results feed the same inventory and severity ratings; the tool also provides a REST API and MCP integration.
hevnsnt
WebCheck brings publicly exposed domain information into one interface: DNS, TLS certificates, HTTP headers, subdomains, detected technologies, and potential threat-list matches. It offers 44 checks and can also examine redirects, trackers, and email configuration.
The results provide a useful starting point for surface-level checks, not a substitute for a thorough audit: some data, such as vulnerabilities linked by Shodan, depends on external sources. The project is open source, can be self-hosted, and provides an API.
Alicia Sykes
The Website Specification: practical technical criteria for websites
This specification brings together 178 topics covering a website’s technical responsibilities, including HTML, accessibility, security, performance, SEO, privacy and resilience. Each topic explains why it matters and how to implement it, with items marked as required, recommended, optional or to avoid.
A yes/no checklist turns those criteria into an audit that teams can revisit after fixes. Grounded in primary sources and platform-agnostic, the specification is also available to agents through a read-only MCP server, with no authentication required for its reference tools.
@jdevalk
Expired domains behind old analytics and advertising tags have been bought and repurposed to redirect visitors to malicious content, including the Coruna and DarkSword iOS exploit kits. Report URI and iVerify describe a chain that filters visitors and tailors its payload to the device; security scanners may receive only an empty response.
The case shows how a forgotten third-party script remains an active dependency: its domain can change hands without any site change. The article recommends auditing tags, monitoring loaded scripts, and restricting their domains with a Content Security Policy.
Scott Helme
WebSub defines a notification protocol between publishers and subscribers: a subscriber discovers a hub, registers a callback URL, and receives updates from the hub over HTTP. The specification covers subscription validation, renewal, and delivery retries, while leaving the mechanism publishers use to notify hubs unspecified.
The updated W3C Recommendation adds safeguards against XSS attacks during subscription verification. It also specifies HMAC signatures for notifications: SHA-1 remains common for compatibility, the document notes, but recommends at least SHA-256 when TLS transport may be compromised.
A critical vulnerability enables unauthenticated remote code execution in some applications using React Server Components. It affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in the versions listed in the advisory, with a CVSS score of 9.5.
The described scenario is rare: it requires responses that transport multiple typed arrays and an attacker-controlled value. React applications without a server are unaffected, as are applications that do not use a framework, bundler, or plugin supporting Server Components. Fixes are available in 19.0.9, 19.1.10, 19.2.9, and 19.3.1; affected deployments should upgrade immediately.
mattcarrollcodeFound via JavaScript Weekly
croc enables sending files or text between two devices with end-to-end encryption, no network setup, and no user account. The tool works via CLI or a web interface, generates a shareable code, and supports multi-file, folder, and resumable transfers. It stands out for its ease of use, cross-platform support, and a user experience often considered more polished than Magic Wormhole.
Zackary Scholl
Next.js releases 16.3.8 and 15.5.27 to address several vulnerabilities, including image optimization SSRF and cache poisoning issues. The advisory identifies affected configurations to help teams prioritize the update.
Sebastian Silbermann, Josh Story et Karim Rahal
Front-End Checklist organizes more than 350 rules into review workflows for accessibility, CSS, performance, security, privacy, and SEO. It offers guided launch and audit checklists, and exposes the same standards to agents through MCP for more structured code reviews.
David Dias
This repository maintains lists of IP addresses identified as malicious and refreshes them automatically every two hours. It also publishes statistics and exclusions for major public DNS resolvers, helping reduce the chance of blocking legitimate services when using the lists.
bitwire-it
Croc transfers files between computers using a shared code and an encrypted relay. The project offers binaries and a web interface without requiring a manually configured transfer server.
This Can I Use entry summarizes browser support for Clear-Site-Data, a header that asks browsers to clear selected site data. Check compatibility before using it in sign-out or security flows.
Infisical organizes application secrets and configuration across environments. Versioning and rotation are among the mechanisms provided for managing their lifecycle.
Bastillion opens SSH sessions from the browser and manages key distribution across registered hosts. It provides a shared interface for access and key rotation.
SafeLine filters and monitors HTTP traffic in front of web applications. The repository explains its reverse-proxy role and the attack classes its protections target.
