2018
-
Disclosure: SQL Injection in Cart66 Pro
Apr 6
Last month I discovered a critical SQL injection vulnerability in the no-longer-developed yet still actively used Cart66 Pro plugin for WordPress. Here are the details …
-
Software Vulnerabilities, Disclosure, and Marketing
Jan 9
Consumers have a certain amount of upgrade fatigue. It’s not uncommon for end users to ignore an update notification for months to avoid the frustration that comes with trying to fix something that worked before the update.
2014
-
Encryption, Information Leakage, and Side-Channel Attacks
Dec 3
Potential side-channel attacks for encryption software can render even the most secure scheme breakable in a trivial manner.
-
jQuery and Cross-site Scripting
Oct 2
Never trust user input, even if it’s coming from an allegedly trustworthy source.
-
DNS and Cross-Site Scripting
Sept 19
One of the first things on any security auditor’s list is checking to see if a site is vulnerable to cross-site scripting (XSS).
-
Interesting Hacking Attempts
Aug 11
When someone hacks a plugin or theme, it’s bad. When someone hacks the foundation of those systems (WordPress), it’s worse. When someone hacks the base upon which WordPress is built (Apache, Nginx, or whatever server you use), it’s tragic.
-
SHA and Length Extension Attacks
Jun 3
Developers keep raising a concern about a particular type of attack that might be related to my Secure XML-RPC proposal. Let me explain why it’s not a concern.
-
PHP, Security, and Lambdas
Apr 28
If you’re writing PHP code and you want to use lambda functions, don’t use PHP’s create_function() method. It’s insecure, and will be flagged as such by security software and analysts.
-
Responsible Disclosure
Apr 10
For all the damage Heartbleed did on its own, disclosing the issue the way it was did far more good than harm.
-
How Secure is the Internet of Things?
Feb 22
How secure are you? Really?