PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Logging: The Silent Security Guard and Its Pitfalls

hackerone.com | vulnerability | #incident-response | #compliance | #best-practices | #security-fundamentals | #pii | #logging
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Logs are the breadcrumbs of security investigations, yet careless practices can leak passwords and PII or expose the logging pipeline to abuse. This post weighs the benefits against the risks.
Published
Collected

Related coverage

blog · hackerone.com
The Top 5 Most Common Security Issues I Discover When Reviewing Code
A veteran code reviewer counts down the five security issues he finds most often, starting with PII and secrets leaking into logs and poor cryptography choices, with Python and Ruby examples.
blog · certik.com
How to Prepare for a CCSS Audit
The CryptoCurrency Security Standard (CCSS) certifies how businesses protect private keys across ten control aspects. This guide explains what the audit covers, the three levels, and how to prepare.
vulnerability · hackerone.com
How an Information Disclosure Vulnerability Led to Critical Data Exposure
Information disclosure makes up 10% of HackerOne findings. The article covers how exposed keys, source code, and PII enable further attacks, plus prevention via error handling and encryption.
vulnerability · bishopfox.com
160K COVID-19 Records: Vulnerability in Avicena Medical Laboratory
Bishop Fox found that Kosovo's Avicena Medical Laboratory exposed ~166,000 COVID-19 test records through missing authorization controls—results were enumerable via an incremental sample number.
vulnerability · borghq.io
PHP2Shell CVE-2026-109618: What to Do Right Now
Facing PHP2Shell CVE-2026-109618? Here is what is verified before the 14:00 UTC patch, what remains unconfirmed, and your patch-day checklist.
vulnerability · hunt.io
[CVE-2026-15409] UK Council Attack Linked to SonicWall SMA 1000 Campaign
Hunt.io links a UK council breach to mass exploitation of SonicWall SMA1000 CVE-2026-15409: LDAP credentials from 168 appliances, secretsdump run on-device, DCSync in five AD environments.
Back