Software Supply Chain Attacks: Where Modern Build Pipelines Break
A build pipeline trusts a long chain of things by default: the package registry, the CI runner, every plugin, every base image. Each link is a place a …
All articles
Every FirewallSync article, newest first.
GitLab CVE-2026-97229: Patch the Regex RCE, Then Hunt
CISA added GitLab CVE-2026-97229, an unauthenticated remote code execution bug in how GitLab compiles regular expressions from CI/CD configuration, to …
Secure File Uploads in Node.js: A Tested Express Setup
Most upload bugs come from trusting something the client sent: the filename, the Content-Type, or the idea that a file sitting in a public folder …
Node.js Decompression Bombs: zlib Limits That Work
A 100 KB gzip body can decompress to 100 MB. Node's maxOutputLength stops that in the one-shot zlib functions, but streams silently ignore it, and …
Magento CVE-2026-48356 (PolyShell): Patch and Hunt
CVE-2026-48356 is the PolyShell file-upload flaw in Adobe Commerce and Magento Open Source. CISA added it to the KEV catalog on October 27, 2026. Here …
PHP session_regenerate_id: Stop Session Fixation Right
Calling session_regenerate_id() at login is the start of PHP session security, not the whole of it. This guide shows the fixation attack strict mode …
Brotli CVE-2026-111497: Find and Patch Every Copy
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, now on CISA's KEV list. It ships inside Node.js, Python packages, Go modules, …
php.ini Security Hardening: Production Settings That Matter
PHP's own php.ini-production template still leaves several security settings at permissive defaults, including strict session mode, cookie flags and …
PHP2Shell CVE-2026-109618 and -109619: Patch, Then Hunt
Two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution against PHP that serves web requests. CISA added …
Kubernetes Audit Log Detections: 8 Rules We Tested
Eight detection rules for the Kubernetes audit log, written as jq filters and mapped to MITRE ATT&CK: exec and debug sessions, pods asking for host …
PAN-OS CVE-2026-0322: Patch the Management Interface RCE
CVE-2026-0322 lets an authenticated attacker who can reach the PAN-OS management interface run code as root on PA-Series and VM-Series firewalls and …
Kubernetes Audit Policy: What to Log, at What Level
A Kubernetes audit policy decides which API requests kube-apiserver records and how much of each it keeps. The first matching rule wins, so one …