BestHub
Sign in

Information Security

Showing 100 articles max
Latest Popular
macrozheng
macrozheng
Sep 1, 2026 · Information Security

Why Sa-Token Is Winning Over Developers: A Java Authentication Efficiency Revolution

Sa-Token has rapidly become the go‑to Java permission framework because it abstracts and automates common security concerns, offers a lightweight Core‑Plugin‑Adapter architecture, supports plug‑in storage like Redis, and lets developers implement login, logout and permission checks with a single line of code, dramatically reducing development time compared with Spring Security.

AuthenticationAuthorizationDistributed Session
0 likes · 16 min read
Why Sa-Token Is Winning Over Developers: A Java Authentication Efficiency Revolution
Top Architecture Tech Stack
Top Architecture Tech Stack
Aug 31, 2026 · Information Security

Massive Claude Account Hijacking – Why Session Cookies Are the Real Threat

A wave of forced logouts on Claude revealed that attackers steal browser session cookies and payment data, turning AI credit limits into a lucrative commodity, and the article walks through the malware families involved, the limitations of password changes, and a detailed remediation checklist for developers.

AI account securityAPI keyBest practices
0 likes · 15 min read
Massive Claude Account Hijacking – Why Session Cookies Are the Real Threat
Java Tech Enthusiast
Java Tech Enthusiast
Aug 28, 2026 · Information Security

Embedding a Whole Website Inside a Favicon: What the Risks Reveal

By encoding a tiny HTML page into an 8×8 pixel favicon, the author demonstrates that a website can be hidden in a seemingly innocuous image, explores the steganographic technique, evaluates its storage limits, and discusses the security implications and practical drawbacks of such a covert channel.

CSPbrowserdata exfiltration
0 likes · 14 min read
Embedding a Whole Website Inside a Favicon: What the Risks Reveal
Black & White Path
Black & White Path
Aug 28, 2026 · Information Security

A Single Missing ‘!’ in nf_tables Triggers Full Root Compromise (CVE‑2026‑23111)

CVE‑2026‑23111 is a local privilege escalation in the Linux kernel’s nf_tables subsystem caused by a reversed conditional in nft_map_catchall_activate(), where the absence of a ‘!’ leads to a use‑after‑free, enabling an attacker to chain UAF, leak kernel addresses, build a ROP payload and gain root.

CVE-2026-23111Linux kernelROP
0 likes · 9 min read
A Single Missing ‘!’ in nf_tables Triggers Full Root Compromise (CVE‑2026‑23111)
dbaplus Community
dbaplus Community
Aug 26, 2026 · Information Security

SQLite Got a 9.8 CVE That Was Actually an AI‑Generated Fabrication

An in‑depth investigation reveals that a batch of high‑severity CVE entries for SQLite, including a CVSS 9.8 rating, were fabricated by AI, disproved through independent testing, and later withdrawn by MITRE, exposing flaws in the current vulnerability disclosure process.

AI‑generatedCISACVE
0 likes · 12 min read
SQLite Got a 9.8 CVE That Was Actually an AI‑Generated Fabrication
Black & White Path
Black & White Path
Aug 26, 2026 · Information Security

How to Discover Unauthorized Access on Edu.cn Sites Using Hunter Queries

The article walks through using a Hunter.io query to locate edu.cn domains with registration pages, then demonstrates step‑by‑step vulnerability hunting—including login probing, directory scanning with the findsomething plugin, exposing an unauthenticated admin backend, and leveraging Burp and WPScan to gather sensitive data.

directory scanninghunter.ioinformation security
0 likes · 3 min read
How to Discover Unauthorized Access on Edu.cn Sites Using Hunter Queries
TechVision Expert Circle
TechVision Expert Circle
Aug 25, 2026 · Information Security

When AI Browsers Get Smarter, Prompt Injection Becomes More Dangerous

Despite layered defenses like input filtering, role isolation, and sandboxed execution, 2026 reports show that prompt‑injection attacks can hijack AI‑enabled browsers to click links, submit forms, leak cookies, and even trigger financial transactions, prompting a detailed analysis of attack vectors, real‑world cases, current mitigations, and emerging defenses.

AI browsersLLM securityPrompt Injection
0 likes · 12 min read
When AI Browsers Get Smarter, Prompt Injection Becomes More Dangerous
Black & White Path
Black & White Path
Aug 25, 2026 · Information Security

Bot and Fraud Detection Complete Guide: Dissecting a Six‑Layer Defense System

The article breaks down bot and fraud detection into a six‑layer onion model, explains the distinction between bots (automation) and fraud (intent), compares manual and automated abuse, and details concrete technical checks—from browser flags and anti‑detection engines to network fingerprints, behavioral biometrics, and business‑logic analysis—illustrated with code snippets, timing attacks, and real‑world examples.

anti‑botanti‑detection engineautomation
0 likes · 28 min read
Bot and Fraud Detection Complete Guide: Dissecting a Six‑Layer Defense System
Black & White Path
Black & White Path
Aug 24, 2026 · Information Security

No‑Credentials RCE: One POST request grants root on Pakistan’s largest bank

A security analysis reveals that an unauthenticated Java deserialization flaw (CVE‑2017‑10271) in Oracle WebLogic's WS‑AT endpoint lets an attacker obtain a root shell on HBL’s internet‑facing banking nodes with a single POST request, then harvest credentials, hijack sessions, persist, and move laterally, while additional related bugs amplify the risk.

CVE-2017-10271Java DeserializationRemote Code Execution
0 likes · 10 min read
No‑Credentials RCE: One POST request grants root on Pakistan’s largest bank
Raymond Ops
Raymond Ops
Aug 23, 2026 · Information Security

Defend Against SSH Brute‑Force Attacks with Fail2ban: Real‑World Auto‑Blocking Guide

This article explains why SSH brute‑force attacks are a real threat, describes Fail2ban's three‑layer workflow, walks through installation and basic SSH jail configuration, details key parameters, shows how to customize filters, actions, and alerts, and provides advanced tuning, troubleshooting, and production‑ready templates for robust SSH protection.

Fail2banLinux securitySSH
0 likes · 34 min read
Defend Against SSH Brute‑Force Attacks with Fail2ban: Real‑World Auto‑Blocking Guide
TechVision Expert Circle
TechVision Expert Circle
Aug 23, 2026 · Information Security

What a CrowdStrike CTO’s Shift to AI Security Investing Reveals About the Industry

The article dissects why CrowdStrike CTO Michael Sentonas left to launch an AI‑focused security venture fund, linking his decision to the fragility of kernel‑level agents, the rise of AI‑native defenses, shifting market economics, and the emerging opportunities for security professionals and startups.

AI securityAutonomous agentsCybersecurity talent shortage
0 likes · 14 min read
What a CrowdStrike CTO’s Shift to AI Security Investing Reveals About the Industry
Architect's Guide
Architect's Guide
Aug 22, 2026 · Information Security

Comprehensive Guide: Implementing RBAC with Spring Security and JWT

This article walks through the fundamentals of Role‑Based Access Control (RBAC), explains the RBAC0‑RBAC3 model hierarchy, demonstrates how to configure Spring Security for in‑memory and database authentication, integrates JWT for stateless token handling, and shows how to enable JSON‑based login and BCrypt password encryption with concrete code examples.

AuthenticationJWTJava
0 likes · 16 min read
Comprehensive Guide: Implementing RBAC with Spring Security and JWT
Raymond Ops
Raymond Ops
Aug 21, 2026 · Information Security

How to Perform a Complete Server Port Security Audit with nmap

This guide walks ops engineers through installing nmap, understanding its scan techniques, executing single‑port, common‑port, full‑range, and script‑based scans, analyzing results, and applying remediation steps such as firewall rules, service hardening, and regular scanning schedules to keep server exposure minimal.

firewalllinuxnmap
0 likes · 32 min read
How to Perform a Complete Server Port Security Audit with nmap
CodeSmart Hoops
CodeSmart Hoops
Aug 21, 2026 · Information Security

Interview Self‑Test: Multi‑Layer Anti‑Sniffing and Data‑Security Strategies

This article presents ten interview‑style questions and detailed answers covering HTTPS handshake, certificate pinning, request signing, replay‑attack defenses, HMAC‑SHA256 vs RSA‑SHA256, AES‑CBC vs AES‑GCM, the limits of front‑end encryption, mTLS operation in micro‑services, key‑rotation design, and why HTTPS alone is insufficient, illustrating a comprehensive, layered security approach.

AES-GCMCertificate PinningHMAC
0 likes · 21 min read
Interview Self‑Test: Multi‑Layer Anti‑Sniffing and Data‑Security Strategies