Browse by topic
Security Engineering
Hands-on security engineering write-ups, including measuring what free Semgrep actually reports, testing a scanner with a harness built to deceive it, tracing MCP server CVEs to root causes, container trust and patch checks, and payment webhook failure handling.
18 posts
-
6 min read
Kunci CA eMudhra Ternyata Cuma Satu Byte. Container Kamu Masih Percaya?
Kunci intermediate CA eMudhra ternyata cuma satu byte. Browser memblokirnya dalam hitungan jam, tapi trust store container kamu belum tentu. Audit 15 menit.
- Security Engineering
- Deployment
-
6 min read
PHP2Shell: The Patch Is Out. Is It Running in Your Containers?
PHP2Shell patches for CVE-2026-109618 and CVE-2026-109619 are out. Five checks to prove the fix is running in your containers, not just released.
- Security Engineering
- Deployment
-
6 min read
The eMudhra CA Keys Were One Byte Long. Does Your Container Still Trust Them?
Eight eMudhra CA keys were one-byte numbers. Browsers blocked them in hours, but containers may not. A 15-minute trust store audit for Docker, Python, Java.
- Security Engineering
- Deployment
-
6 min read
UUIDv7 Is a Great Database Key and a Bad Clock: 4 Tests Before You Migrate
UUIDv7 is a great database key but a poor clock. Four quick tests, what the embedded timestamp leaks, and a rule of thumb for using UUIDv7 as a primary key.
- Security Engineering
- Engineering Practice
-
10 min read
I Traced 29 CVEs in One MCP Server to 4 Root Causes
29 mcp-atlassian CVEs traced to 4 root causes: DNS rebinding, credential fallback, tool allowlist and file_path. The safe version floor is 0.23.1, not 0.22.0.
- MCP Security
- Security Engineering
-
10 min read
MCP Servers Had a Rough 48 Hours: 4 Unauthenticated CVEs
Four MCP servers published unauthenticated CVEs in about 35 hours, plus LiteLLM's KEV-listed bypass. Fixed versions and a checklist to audit your MCP servers.
- MCP Security
- Security Engineering
-
6 min read
The fake browser extension playbook is back. This time it ships as agent skills
Malicious agent skills repeat the fake browser extension playbook: 341 of about 2,632 ClawHub skills were malicious. Five tells to check before you install a skill.
- AI Security
- Security Engineering
-
6 min read
The LiteLLM Supply Chain Backdoor: What 3 Hours Means for Your AI Agent Gateway
Two backdoored litellm versions, 1.82.7 and 1.82.8, sat on PyPI on March 24, 2026. What the window means for your AI agent gateway and how to pin builds.
- AI Security
- Security Engineering
-
5 min read
The payment webhook failure I had to inject on purpose
Most webhook tests skip partial database failure. I injected one on purpose in a payment webhook lab and show how a correlation key and review queue recover.
- Integration Reliability
- Security Engineering
-
4 min read
My Scanner Passed Until I Built a Harness That Lied to It on Purpose
I built a harness of synthetic attack fixtures to test my own scanner, mcpscan: 6 of 7 fired, and the miss, a leaked key in a JSON config, taught me the most.
- MCP Security
- Security Engineering
-
2 min read
Benchmarking My MCP Security Scanner: 14 of 14 Findings, Zero False Positives
MCP security scanner benchmark: 14 of 14 planted findings detected, 0 false positives across 5 fixtures and 24 tools, at a median 82 microseconds per manifest.
- MCP Security
- Security Engineering
-
4 min read
A Valid Payment Webhook Can Still Be Dangerous to Process Twice
A valid payment webhook can still corrupt order state when processed twice. Four fixes: raw body HMAC, idempotency, order states and bounded retries.
- Integration Reliability
- Security Engineering
-
5 min read
The Cursor Allowlist Bypass That Starts With a File Named curl
CVE-2026-22708 is a Cursor allowlist bypass that starts with a file named curl. I built a static shadowing check for it and explain two gaps it cannot close.
- AI Security
- Security Engineering
-
6 min read
My MCP Security Scanner Missed 2026's Worst MCP RCE: Here Is the One-Rule Fix
My mcpscan path traversal rule MCP007 only covered file reads and missed four 2026 MCP CVEs, including a CVSS 9.1 RCE. Here is the write-sink fix.
- MCP Security
- Security Engineering
-
6 min read
Two ways to reuse a privileged CI token (and my rule only caught one)
A GitHub Actions workflow_run rule that caught only one of two attack shapes, checkout reuse and artifact reuse, and how I split it into MCP019 and MCP020.
- Security Engineering
- Security Automation
-
8 min read
We Planted 10 Vulnerabilities to Test Free Semgrep. It Reported 3.
We planted 10 vulnerabilities in a React and TypeScript app and ran free zero-config Semgrep. It reported 3 of 10. Here is why and how to close the gap.
- Security Engineering
- Engineering Practice
-
7 min read
We thought we had location-based MFA. We had something else entirely
Location-based MFA audit in Entra ID Conditional Access: no location policies existed, legacy per-user MFA was doing the prompting, and how to migrate safely.
- Identity
- Security Engineering
-
Medium ↗
The Hidden Attack Surface: PDF Metadata & Information Leakage
What your PDFs reveal about your infrastructure, and how to stop that reconnaissance in C# and .NET.
- Security Engineering
- Data Privacy