--- title: "#appsec articles | Hashnode" description: "Explore 211 articles tagged #appsec on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/appsec" --- Tag # #appsec 211 posts · 22 followers [Excession Labs](https://hashnode.com/@excessionlabs) · [1h ago](https://hashnode.com/posts/pkce-testing-authorization-code-interception-locally/6af4c7eaa6ece761d6fa3946) ### [PKCE: testing authorization code interception locally](https://excessionlabs.hashnode.dev/pkce-testing-authorization-code-interception-locally?utm_source=hashnode&utm_medium=feed) PKCE: testing authorization code interception locally PKCE (Proof Key for Code Exchange, RFC 7636) makes a stolen authorization code useless on its own. In our local toy server without PKCE, a party h 10 min read · [excessionlabs.hashnode.dev](https://excessionlabs.hashnode.dev/pkce-testing-authorization-code-interception-locally?utm_source=hashnode&utm_medium=feed) [Excession Labs](https://hashnode.com/@excessionlabs) · [20h ago](https://hashnode.com/posts/row-level-security-three-postgres-mistakes-tested/6af3c2527ca091ae936c9627) ### [Row level security: three Postgres mistakes, tested](https://excessionlabs.hashnode.dev/row-level-security-three-postgres-mistakes-tested?utm_source=hashnode&utm_medium=feed) Row level security: three Postgres mistakes, tested Row level security (RLS) is a PostgreSQL feature that limits which table rows each role can read or write, based on policies. In a throwaway Postgre 9 min read · [excessionlabs.hashnode.dev](https://excessionlabs.hashnode.dev/row-level-security-three-postgres-mistakes-tested?utm_source=hashnode&utm_medium=feed) [2](https://hashnode.com/posts/row-level-security-three-postgres-mistakes-tested/6af3c2527ca091ae936c9627) [Excession Labs](https://hashnode.com/@excessionlabs) · [20h ago](https://hashnode.com/posts/graphql-introspection-disabling-it-leaves-the-field-open/6af3c1fede442c2445ddd0fa) ### [GraphQL introspection: disabling it leaves the field open](https://excessionlabs.hashnode.dev/graphql-introspection-disabling-it-leaves-the-field-open?utm_source=hashnode&utm_medium=feed) GraphQL introspection: disabling it leaves the field open GraphQL introspection lets a client ask the server for its whole schema. Turning it off hides the field list, but a client that knows or guess 9 min read · [excessionlabs.hashnode.dev](https://excessionlabs.hashnode.dev/graphql-introspection-disabling-it-leaves-the-field-open?utm_source=hashnode&utm_medium=feed) [Excession Labs](https://hashnode.com/@excessionlabs) · [20h ago](https://hashnode.com/posts/ssrf-reproduce-bypass-and-fix-a-preview-endpoint/6af3c19ec86ae5551bad0419) ### [SSRF: reproduce, bypass, and fix a preview endpoint](https://excessionlabs.hashnode.dev/ssrf-reproduce-bypass-and-fix-a-preview-endpoint?utm_source=hashnode&utm_medium=feed) SSRF: reproduce, bypass, and fix a preview endpoint Server-side request forgery (SSRF) is a flaw where a server fetches a URL chosen by the caller, so the caller can reach hosts that only the server c 9 min read · [excessionlabs.hashnode.dev](https://excessionlabs.hashnode.dev/ssrf-reproduce-bypass-and-fix-a-preview-endpoint?utm_source=hashnode&utm_medium=feed) [Jakson Tate](https://hashnode.com/@jakson-tate) · [5d ago](https://hashnode.com/posts/patching-nodejs-brotli-cve-2026-111497/6aed7b26bc14796ad36e0367) ### [Node.js October 2026 Security Release: Brotli CVE-2026-111497 & SRE Patch Guide](https://servermo.hashnode.dev/patching-nodejs-brotli-cve-2026-111497?utm_source=hashnode&utm_medium=feed) Decompression attack vectors, TLS bypasses, PRNG snapshot flaws, and host/container patching playbooks. 7 min read · [servermo.hashnode.dev](https://servermo.hashnode.dev/patching-nodejs-brotli-cve-2026-111497?utm_source=hashnode&utm_medium=feed) [Jakson Tate](https://hashnode.com/@jakson-tate) · [5d ago](https://hashnode.com/posts/patching-php2shell-cve-2026-109618/6aed7188a44e0311965a3156) ### [PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Technical Architecture, SAPI Exposure Analysis, and SRE Remediation Guide](https://servermo.hashnode.dev/patching-php2shell-cve-2026-109618?utm_source=hashnode&utm_medium=feed) Critical Infrastructure Security Advisory | CVSS v4.0 Score: 9.2 (Critical) 18 min read · [servermo.hashnode.dev](https://servermo.hashnode.dev/patching-php2shell-cve-2026-109618?utm_source=hashnode&utm_medium=feed) [Hackbox.ai](https://hashnode.com/@hackbox) · [6d ago](https://hashnode.com/posts/why-your-authorization-tests-pass-while-the-bug-ships/6aebf9ba2f7fc2d001d1dce7) ### [Why Your Authorization Tests Pass While the Bug Ships](https://hackboxai.hashnode.dev/why-your-authorization-tests-pass-while-the-bug-ships?utm_source=hashnode&utm_medium=feed) Most authorization tests pass while the bug ships. Why a finding needs the reproducing request, and how to turn one into a failing test in CI. 4 min read · [hackboxai.hashnode.dev](https://hackboxai.hashnode.dev/why-your-authorization-tests-pass-while-the-bug-ships?utm_source=hashnode&utm_medium=feed) [Coding Macaw Bootcamp](https://hashnode.com/@codingmacawbootcamp) · [Oct 26](https://hashnode.com/posts/securing-the-edge-building-ai-resistant-apis-in-next-js-and-rust/6adf5f3d68afba8fc152d324) ### [Securing the Edge: Building AI Resistant APIs in Next.js and Rust](https://codingmacawbootcamp.hashnode.dev/securing-the-edge-building-ai-resistant-apis-in-next-js-and-rust?utm_source=hashnode&utm_medium=feed) Learn how to secure Next.js Server Actions against AI automated attacks. Master Zod validation, Rust WebAssembly for top tier US engineering roles. 4 min read · [codingmacawbootcamp.hashnode.dev](https://codingmacawbootcamp.hashnode.dev/securing-the-edge-building-ai-resistant-apis-in-next-js-and-rust?utm_source=hashnode&utm_medium=feed) [Daniel Isaac E](https://hashnode.com/@Daniel-Isaac-E) · [Oct 24](https://hashnode.com/posts/php2shell-inside-two-critical-php-core-vulnerabilities-that-enable-unauthenticated-rce/6add0e1e0c186189262be56f) ### [PHP2Shell: Inside Two Critical PHP Core Vulnerabilities That Enable Unauthenticated RCE](https://danielisaace.hashnode.dev/php2shell-inside-two-critical-php-core-vulnerabilities-that-enable-unauthenticated-rce?utm_source=hashnode&utm_medium=feed) Understanding CVE-2026-109618 and CVE-2026-109619, the memory-management failures behind them, and what defenders should do now. On October 21, 2026, the PHP development team disclosed two critical vu 9 min read · [danielisaace.hashnode.dev](https://danielisaace.hashnode.dev/php2shell-inside-two-critical-php-core-vulnerabilities-that-enable-unauthenticated-rce?utm_source=hashnode&utm_medium=feed) [Dimakatso Sebatane](https://hashnode.com/@ovawatch-security) · [Oct 18](https://hashnode.com/posts/case-study-cross-tenant-data-exfiltration-via-backup-restore/6ad6108301bf51809c3a6b0f) ### [Case Study: Cross-Tenant Data Exfiltration via Backup Restore](https://ovawatch-security.hashnode.dev/case-study-cross-tenant-data-exfiltration-via-backup-restore?utm_source=hashnode&utm_medium=feed) How broken tenant isolation and missing authorization checks in backup restoration can allow attackers to access sensitive data belonging to other organizations. Full video at : https://youtu.be/AshvGLWsclw 9 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-cross-tenant-data-exfiltration-via-backup-restore?utm_source=hashnode&utm_medium=feed)