CyberSecFix roundup: recurring application security themes
A short editorial roundup of durable application security themes worth revisiting, framed as evergreen guidance rather than breaking news.
Practitioner-focused security research
Helping You Build, Break, and Secure Applications Smarter
CyberSecFix publishes technical, reproducible security content covering application and API security, cloud, AI, and vulnerability research, written for people who build and break systems.
Authentication bypass via inconsistent path normalization
A walkthrough of how mismatched path handling between a proxy and an application can bypass authentication controls, and how to prevent it.
Editor's selection
Featured research
Fresh from the lab
Latest articles
CVE-2026-00000 (illustrative): authentication bypass in a sample gateway
A fully fictional CVE used to demonstrate how CyberSecFix presents CVE analysis: metadata, affected versions, technical detail, detection, and remediation.
How to read a CVE: an illustrative analysis walkthrough
A framework for turning a terse CVE record into an actionable understanding of risk, prerequisites, impact, and whether it applies to you.
Insecure deserialization leading to remote code execution
A sample analysis of how deserializing untrusted data can escalate to remote code execution, with request/response evidence, detection, and remediation.
Authentication bypass via inconsistent path normalization
A walkthrough of how mismatched path handling between a proxy and an application can bypass authentication controls, and how to prevent it.
How to evaluate a DAST tool for your pipeline
Dynamic application security testing tools vary widely. Criteria for evaluating coverage, accuracy, and fit before you adopt one.
Deep dives
Vulnerability research
Insecure deserialization leading to remote code execution
A sample analysis of how deserializing untrusted data can escalate to remote code execution, with request/response evidence, detection, and remediation.
Authentication bypass via inconsistent path normalization
A walkthrough of how mismatched path handling between a proxy and an application can bypass authentication controls, and how to prevent it.
Server-side request forgery through user-configurable webhooks
Webhook features let users tell your server where to send requests, a natural home for SSRF. How the flaw arises and how to constrain outbound requests.
Offensive security
Penetration testing
SQL injection lab walkthrough: from detection to extraction
A hands-on walkthrough of finding and exploiting a classic SQL injection in a deliberately vulnerable lab, then confirming and reporting it responsibly.
Testing for BOLA with Burp Suite: a repeatable workflow
A step-by-step workflow for finding object-level authorization flaws in APIs using an intercepting proxy and two authenticated sessions.
API reconnaissance basics: building a map before you test
Effective API testing starts with reconnaissance. How to enumerate endpoints, understand auth, and model the API before probing for flaws.
Build secure
Application security
IDOR vs BOLA: are they the same thing?
IDOR and BOLA describe closely related authorization failures. This piece clarifies the terminology and when each label is the more precise one.
A methodology for IDOR testing in web applications
A structured approach to hunting IDOR in traditional web apps: identifying references, classifying them, and proving cross-user access.
Interfaces & data
API security
What is BOLA? Broken Object Level Authorization explained
A clear introduction to Broken Object Level Authorization (BOLA), why it tops the OWASP API Security list, how it happens, and how to reason about it.
An API security checklist for engineering teams
A pragmatic checklist covering authentication, authorization, input handling, and observability for teams shipping and maintaining APIs.
Infrastructure
Cloud security
Least privilege in cloud IAM: a practical mental model
Least privilege is easy to state and hard to operate. A practical model for scoping cloud identities, permissions, and trust relationships.
Hardening cloud object storage against accidental exposure
Object storage misconfiguration remains a leading cause of data exposure. A guide to defaults, access models, and guardrails that prevent it.
Emerging
AI security
Prompt injection: the input-trust problem for LLM applications
Prompt injection is the LLM-era manifestation of a classic problem: mixing untrusted input with trusted instructions. An introduction for builders.
Model supply chain risk: what you inherit when you pull a model
Downloading a model is a supply-chain decision. What to consider about provenance, serialization formats, and the code that runs at load time.
Tooling
Security tools
How to evaluate a DAST tool for your pipeline
Dynamic application security testing tools vary widely. Criteria for evaluating coverage, accuracy, and fit before you adopt one.
Building a lightweight API testing toolkit
You do not need a heavy platform to test APIs effectively. The small set of composable tools that cover most day-to-day API testing.