Vulnerability Alert: FCKeditor Arbitrary File Upload

A Metasploit module turns arbitrary file upload into shells on Windows backends: its JSP, PHP, or ASPX webshells launch base64-encoded PowerShell commands running MSF payloads past antivirus.

NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.

Wopper is a NetSPI tool that automates WordPress code execution from admin credentials: it uploads, executes, obfuscates, and self-deletes PHP files in seconds, replacing manual plugin upload steps.

A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.

A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.