Field guide to CAPTCHA types and how they break
The guide reviews various CAPTCHA implementations and common bypass techniques.
Stories per day · 30 days
2 RSS
Relatedphp2rce22fa1agent-interfaces1ai-agent1ai-agents1anomaly-detection1authentication-bypass1captcha1cve-2026-1080971deception1decoy1defense-synthesis1deserialization1drupal1exploitability1field-ui1java1
30 stories, newest first · one card per story
Stories tagged #web-security
Fast-Tier Models Miss Held-Out Web Attack Families
ModernBERT classifies 37-60% of held-out path traversal as benign within 5% budget; specialized models escalate 97.6% but may include public families in training.
WebMaze steers LLM web scanners into decoy worlds
On 12 applications and three scanners, decoy pages averaged 93.0% of distinct pages requested per run.
Agent interfaces leave 91% of tested web flaws exploitable
VELA covers 44 vulnerabilities in twelve web families; interface design shifted exploit retention from 39% to 95%.
JANUS synthesizes cross-layer defenses for deserialization attacks
On 16 Java and PHP deployments, held-out attack success fell to 6.2% while 98.4% of benign tests still passed.
PHP warns of unpatched RCE in rare session setup (CVE-2026-115560)
Only apps that switch the session serialize handler at runtime and leave upload progress on are exposed; no attacks on this bug are reported.
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal patched critical Field UI RCE CVE-2026-108097, reachable without login through some contributed modules, with no attacks reported.
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
Reflectiz says its AI pentest agent found a critical OTP bypass on a major insurer's website.
3
Google's PageBreak AI Agent Finds 500 Flaws in Its Web Apps
Google's PageBreak AI agent reportedly found 500 flaws in the company's own web applications.
Google’s AI Hacker Finds 500+ XSS Flaws and Builds Working Exploit Chains
Google's PageBreak agent verified over 500 XSS flaws, including exploit chains, in its own web applications.
Google PageBreak AI Agent Finds Over 500 XSS Vulnerabilities Across Its Web Applications
Google's PageBreak AI agent validated over 500 XSS flaws in its own web apps using exploit-backed deterministic validation with near-zero false positives.
AI Agents Aimed SQL Injection at US and Canadian Government Sites
Researchers say AI agents probed US and Canadian government sites with SQL injection while fetching public data, with no confirmed breach.
2
One Pipeline Does Not Fit All: TAILOR, a Type- and State-Aware Framework for CVE Reproduction
TAILOR, a type- and state-aware multi-agent framework, automatically reproduces complex CVEs and packages auditable trigger evidence.
Cross-Site Scripting (XSS) Cheat Sheet
PortSwigger's XSS cheat sheet lists filter-bypass patterns for script injection across major browsers, without a new CVE.
2
CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
Low-severity reflected XSS vulnerability disclosed in Apache Sling XSS library's getValidHref() method, patched in v2.4.12.
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
WordPress patched critical CVE-2026-87902 (CVSS 9.2), an unauthenticated flaw that can execute code on some servers.
4
New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches
YesWeHack researcher details cache key injection against Nginx, enabling access control bypass, cache poisoning, denial of service, and potential stored XSS.
1
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
WordPress 7.1.1 patches Click2Shell, a flaw letting crafted links force-install themes on admin visits, chainable to remote code execution; no exploitation observed.
3
HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)
RFC 10008 standardizes the HTTP QUERY method, creating potential WAF inspection bypasses, cache poisoning, and CSRF gaps because most defenses don't recognize the new verb.
1
Most WordPress pros still lack a breach recovery plan
Melapress survey of 319 WordPress professionals finds most have faced incidents but fewer than 30% maintain a breach recovery plan.
1
Unifying Client-Side Protection in Akamai Application Protection Platform
Akamai announced unified client-side protection capabilities integrated into its Akamai Application Protection Platform.
You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements
Evaluation of 500k Tranco and 24.8M Common Crawl hosts shows Top-N domain sampling biases web security measurements; probability sampling yields unbiased estimates.
MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks
Critical XSS CVE-2026-85061 in MapLibre GL JS enables zero-click attacks on an estimated 2.7 million users; fixed in maplibre-gl 6.4.1.
3
Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests
Reflectiz launched a multi-agent AI penetration testing platform for websites, claiming up to 10x more coverage than conventional pentests.
2