#application-security

Atlassian and Splunk Security Patches Highlight the Growing Risk of Enterprise Software…

Enterprise software platforms sit at the center of modern business operations. Collaboration tools, development platforms, monitoring…

Session Management: Idle Timeouts and Step-Up Auth (Android)

Part 9 of our Android security series. Part 8 covered Credential Manager — getting the user signed in. This post covers what happens for…

Credential Manager and Modern Sign-In (Android)

Part 8 of our Android security series. Part 7 covered BiometricPrompt — this post covers what happens before that: how the user actually…

BiometricPrompt Done Right (Android)

Part 7 of our Android security series. Part 6 covered where to store sensitive data — this post covers a common mistake in gating access to…

EncryptedSharedPreferences vs SQLCipher vs Room + Tink: What Should You Actually Use?

Part 6 of our Android security series, kicking off Phase 2: Data & Auth. Part 5 covered Android Keystore — this post is about the layer…

Top 5 PHP Frameworks for Web Development in 2025

Originally published on the Innostax Engineering Blog

Releasing Faction 2.0 at BlackHat Arsenal 2026🎉

I’m excited to announce that I’ll be returning to Black Hat Arsenal 2026 in Las Vegas and SecTor 2026 in Canada to demo OWASP Faction 2.0 —…

The Wristband Problem

The Docket: Gitea Docker Turned Proxy Trust Into Identity Bypass

OWASP Top 10 2025 A01: Where Broken Access Control Fails in Real Applications

Authentication works. The UI looks correct. The happy path passes. But access control still fails when the application checks the wrong…

OWASP ASVS Explained for Non-Technical Founders

A framework for turning “is our app secure?” into a defensible answer, how OWASP ASVS’s three levels turn security spend into a business…

I Audited a Vibe-Coded Startup. Then I Found Out 98% of AI-Built Apps Have the Same Flaws.

Vibe coding shrank the distance from idea to production. The security judgment that used to come with the engineers didn’t make the trip.

CVE-2026–10087: Cross-Site Scripting in GitLab EE Analytics Dashboard

When analytics dashboards become a client-side execution surface

How to Apply OWASP ASVS in Your Code, A Developer’s Verification Checklist

Mapping of OWASP ASVS requirements for auth, injection, CORS, business logic, request smuggling to real Express/Node examples, plus how to…

Same Flaw, Opposite Verdict: AI Agents Can't Agree What Counts as a Security Vulnerability

I found three ways past an AI agent's safety gate. One was quietly fixed, two were closed as "by design" — yet the same bug class is a…

Stop Ignoring Brakeman Warnings: The Hidden Meaning Behind CWE Codes

Learn how CWE mappings expose critical vulnerabilities like SQL Injection and XSS before they reach production.

The Problem With Signature-Based WAFs (And How We’re Solving It Differently)

Traditional WAFs are useful, but many still depend heavily on rules, signatures, and constant tuning. GladiosWAF takes a different approach…

What Does “Intuition Work” Mean for Security Engineers — and Are You Ready for It?

For years the narrative was about augmentation: AI makes security engineers faster, more accurate, better at handling volume. The human…

You’re Probably Overpaying for the Tokens That Find Your Vulnerabilities

The most expensive, most sophisticated security model on our benchmark finished tenth. A model that costs a dollar to run beat it. Here’s…

Clinejection: One Misconfigured GitHub Action Can Compromise Your App (Deep Dive & Lessons Learned)

Welcome to another story in the Lessons Learned series, where we discuss real-world vulnerabilities from the perspective of an application…

Before You Deploy, Ask One Question: Are Your Gems Secure?

A hands-on introduction to Bundler Audit, CVEs, dependency security, and safer Ruby deployments.

How I Bought a Product for ₹1 and Forged an Admin Session: A Live Web CTF Walkthrough

In application security, a common phrase is: “Security tools look for known patterns, but human testers look for logical mistakes.”

An Open Invitation to Anthropic: Fable 5 Came 10th on RealVuln. Help Us Put Mythos 5 on the Board.

We put Claude Fable 5 — the public version of “the world’s most dangerous AI” — on an open security benchmark. It landed mid-pack. But the…

Critical — Authenticated Remote Code Execution (RCE) via Unrestricted File Upload

Executive Summary

08: Application Security for AI Products— Certified LLM Security Professional : සිංහල

මේ module එකේ focus එක තමයි AI products වල AppSec.

Understanding CORS Misconfiguration and How It Can Be Exploited

Before discussing CORS misconfigurations, it is important to understand what CORS is and why it exists.

Secure Client-Side Architecture Series — Part 1

An Engineering Guide to Client-Side Data Storage

Building a Parallel Security Gate in CI: Combining Secret Scanning, Dependency Audits, and SAST…

One of the biggest challenges in DevSecOps isn’t convincing teams that security matters.

Shift Security Left: Detecting Code Vulnerabilities Early with CodeQL in GitHub Actions

Most CI pipelines are great at answering one question:

How Claude Code Helps Backend Developers Build Production-Level Applications Faster

Modern backend development is no longer just about writing code.

🛡️ OWASP ZAP Deep Dive: The DevSecOps Guide to Automated Web Security Testing

The Silent Heist: How the Latest GitHub Vulnerability Shook the Tech World

What if the ultimate security backdoor wasn’t forced through your firewall, but delivered directly to your codebase, signed and verified by…

I Scanned 10 Popular F-Droid Apps With My Security Scanner — Open Source ≠ Secure

“It’s open source, so it’s secure.”

How Hackers Are Manipulating AI Using Prompt Injection

Before We Begin Let’s Understand What Even Is AI?

SSRF in PDF and HTML Rendering Pipelines: What Puppeteer-Style Services Get Wrong

Originally published at https://koltesecurity.com on May 23, 2026.

Galaxy Dash: Accessing Other Users’ Deliveries via IDOR

Platform: BugForge Category: Insecure Direct Object Reference (IDOR)

WebVerse Lab Walkthrough: Voucher Vault

Voucher Vault: Exploiting UNION-Based SQL Injection to Extract Hidden Admin Data

The Hidden Risk Inside Password Reset Links

Why password reset tokens in URLs can quietly expose user accounts — and what developers should do differently.

REASONING vs RULES : Part 2 — The Feedback Engine: How the Colosseum Learns Faster Than Threats…

In Part 1 of the blog series, The arena was set. Now we start building the engine that wins.

The Security Debt Nobody Is Measuring: AI-Generated Code Is Entering Production Faster Than…

The software industry is in the middle of a quiet crisis, and most engineering teams have not noticed yet.

Anthropic Quietly Fixes Claude Code Sandbox Bypass: A Wake-Up Call for AI Security

The rapid adoption of AI-powered coding assistants is transforming how developers write, test, and deploy software. Tools like Claude Code…

Cloudflare Is Not Enough: The Security Gaps That Still Sit Behind the WAF

Cloudflare is one of the most common answers I hear when I ask a business how its website or application is protected.

Your SDK Dependencies May Be Parsing Untrusted XML Without Protection

Your SDK dependencies may be parsing untrusted XML without protection — and you wouldn’t know until an incident.

Security Through Obscurity: Does Hiding Information Really Improve Cybersecurity?

In cybersecurity, one principle has sparked debate for decades among security professionals, researchers, and system administrators…

My DEF CON 2026 Training Experience in Singapore

Insight from my DEF CON training: Harnessing LLMs for Application Security.

Secure by Design: Building Cybersecurity Into Technology From the Beginning

In today’s rapidly evolving digital world, organizations face an endless stream of cyber threats ranging from ransomware attacks and data…

Lifecycle Operations & Metrics That Matter

Rule management, issue remediation workflows, and the metrics framework that keeps your SAST program honest — because tools are only as…

Scaling, Governance & the Bigger Picture

Turning a technical implementation into a sustainable program — adoption strategies, governance models, and the holistic security posture…

How to Build a World-Class SAST Program from Scratch

A practitioner’s guide to transforming static analysis security testing — from creating the vision to selecting the right tools through…

How to Find Real Vulnerabilities Using Source -> Flow -> Sink

There are several mental models worth building as a security engineer. This is one of the more practical ones — and one that’s often…