Writing
web security
3 articles on this subject.
Argument injection: how a soft hyphen became CVE-2024-4577 and put 9.8 on the board
You escaped the shell metacharacters and the command still ran. Argument injection is the bug that survives shell-safe APIs, here is the mechanism, the PHP-CGI case that got mass-exploited, and the one-character fix.
7 min read
Server-side template injection: why {{7*7}} is a bad test, and how CVE-2023-22527 got to CVSS 10.0
Most SSTI write-ups teach one Jinja2 payload and stop. Here is the actual bug class, the per-engine probe table, a lab you can build in ten minutes, and the code-review rule that removes it entirely.
9 min read
An LLM is not a security boundary: building a moderation layer, then walking through it
We built a kids' chat app where a language model decides which messages are safe, then attacked the decision. Prompt injection is OWASP's number one LLM risk for the second edition running, and the reason is structural.
8 min read