+ Blog

Tutorials and deep-dives on development, security, and devops.

October 19, 2026 · Sécurité

Critical Next.js Vulnerabilities, October 2026: Are You Affected and How to Fix Them

On October 14, 2026, Vercel shipped an out-of-band fix for two critical unauthenticated remote code execution flaws and a denial-of-service bug in Next.js. Here is how to tell whether your app is exposed and how to patch it properly.

Read article ↗
October 19, 2026 · DevSecOps

npm in 2026: Booby-Trapped Packages, Hijacked Trusted Publishing and How to Protect Yourself

Over 1,500 npm packages exposed to takeover through a Trusted Publishing flaw, fake dotenv packages hiding malware in an image, worms spreading from package to package: the JavaScript supply chain has never been under so much attack. Maintainers and developers, here is what to do.

Read article ↗
October 19, 2026 · IA & Cybersécurité

Securing Your MCP Servers: OAuth Token Theft, Command Injection and Prompt Injection

The Model Context Protocol (MCP) connects LLMs to your tools, files and APIs. In 2026 it has also become a target: OAuth tokens hijacked through the official SDK, command injection via the STDIO transport, and prompt injection leading to code execution. Here is how to fix and harden your integrations.

Read article ↗
October 19, 2026 · Infrastructures & Ops

VPNs and Remote Access, Attackers' Top Target: Fixing Ivanti and BeyondTrust

In October 2026, Ivanti Connect Secure and BeyondTrust Remote Support joined CISA's catalog of actively exploited vulnerabilities, with authentication bypasses used by espionage groups. How to patch, check that you weren't compromised, and reduce the exposure of your remote access gateways.

Read article ↗
September 7, 2026 · IA & Cybersécurité

Securing LLM Applications: Guide against Prompt Injections & Data Exfiltration

With the massive adoption of LLMs and RAG in enterprise IT, Prompt Injection and data exfiltration have become the #1 threat in the OWASP Top 10 for LLMs. Discover how to build a secure AI architecture.

Read article ↗
September 6, 2026 · Sécurité API

REST & GraphQL API Auditing: Eliminating BOLA/IDOR Vulnerabilities in Node.js & Next.js

BOLA (Broken Object Level Authorization) causes over 80% of API data breaches. Learn how to audit, detect, and remediate object-level authorization vulnerabilities with strict access controls.

Read article ↗
September 5, 2026 · DevSecOps

Securing the Software Supply Chain: Artifact Signing & CI/CD Hardening

Supply chain attacks targeting NPM, PyPI, and Docker dependencies are escalating. Learn how to harden CI/CD runners and sign artifacts using Cosign/Sigstore.

Read article ↗
September 4, 2026 · Reverse Engineering

From Binary to PoC: Dynamic Analysis and Decompilation with Ghidra & Frida

Dissect native executables (x86/ARM) without source code. Learn to combine Ghidra static reverse engineering with Frida real-time dynamic hooking.

Read article ↗
September 3, 2026 · Infrastructures & Ops

Hardening a Production Linux Server: 10 Golden Hardening Rules

Discover the 10 core security rules to harden Ubuntu/Debian/RHEL production Linux servers against automated brute-force attacks and container escapes.

Read article ↗
June 25, 2026 · Sécurité

Securing a Node.js/Express API: The 5 Golden Rules

Securing your API endpoints is crucial in production. Discover the five core best practices to shield your Node.js backend against common attacks.

Read article ↗
June 18, 2026 · Reverse Engineering

Introduction to Binary Reverse Engineering with Ghidra

Discover the basics of reverse engineering using the NSA's open-source tool, Ghidra. Learn how to analyze a C binary and understand its logical flow.

Read article ↗
June 10, 2026 · DevOps

Dockerizing and Optimizing a Next.js Application

Learn how to write a highly optimized multi-stage Dockerfile for Next.js in production to reduce image size by 90% and strengthen security.

Read article ↗