Cybersecurity guides, scripts, and tools: hardening, network security, cryptography, and authorized penetration testing.https://security.furybee.org/en-ushttps://security.furybee.org/articles/nodejs-security-releases-oct-2026-brotli-tls/https://security.furybee.org/articles/nodejs-security-releases-oct-2026-brotli-tls/Ten CVEs fixed in Node.js 26.12.1, 24.22.1 and 22.23.4, including a Brotli decoder out-of-bounds write and several TLS hostname-verification bypasses. Who is exposed, how to audit Docker fleets, and what to do about end-of-life lines and dependencies stuck on old Node.Thu, 22 Oct 2026 00:00:00 GMTHardeningnodejscvercetlsbrotlidockerwebsocketpatch-managementhttps://security.furybee.org/articles/php-critical-rce-oct-2026-cve-2026-109618-109619/https://security.furybee.org/articles/php-critical-rce-oct-2026-cve-2026-109618-109619/Two unauthenticated RCEs fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. What the bugs are, who is exposed, how to patch distro and Docker installs, and the php.ini, FPM, Apache and proxy mitigations to apply until you can.Wed, 21 Oct 2026 00:00:00 GMTHardeningphpcvercephp-fpmapachedockerwafpatch-managementhttps://security.furybee.org/articles/mfa-fatigue-push-bombing/https://security.furybee.org/articles/mfa-fatigue-push-bombing/How attackers wear down users with repeated MFA prompts, why push and SMS codes are weak against it, and how number matching, phishing-resistant factors and monitoring stop it.Wed, 14 Oct 2026 00:00:00 GMTAuthenticationmfapush-bombingauthenticationidentityphishingfido2https://security.furybee.org/articles/idor-broken-access-control/https://security.furybee.org/articles/idor-broken-access-control/What IDOR and broken access control are, why they dominate real-world findings, how to test for them in authorized assessments, and how to enforce authorization correctly.Fri, 09 Oct 2026 00:00:00 GMTPentestidoraccess-controlauthorizationpentestowaspapi-securityhttps://security.furybee.org/articles/session-management-cookies/https://security.furybee.org/articles/session-management-cookies/How to build secure web sessions: cookie flags, SameSite and CSRF, fixation and rotation, expiry and revocation, and why localStorage is a risky home for tokens.Tue, 29 Sep 2026 00:00:00 GMTAuthenticationsessionscookiessamesitecsrfauthenticationweb-securityhttps://security.furybee.org/articles/dns-security-dnssec-doh/https://security.furybee.org/articles/dns-security-dnssec-doh/How DNS resolution can be spoofed or hijacked, what DNSSEC, DoT and DoH each protect, and how to harden registrar accounts, zones and resolvers against takeover.Wed, 16 Sep 2026 00:00:00 GMTNetworkdnsdnssecdohdothijackingnetwork-securityhttps://security.furybee.org/articles/honeypots-canary-tokens-detection/https://security.furybee.org/articles/honeypots-canary-tokens-detection/Deploy low-interaction honeypots, canary tokens, and honey accounts to get high-confidence intrusion alerts with almost no false positives and minimal ongoing cost.Fri, 04 Sep 2026 00:00:00 GMTNetworkhoneypotcanary-tokensdetectiondeceptionnetwork-securitydockerhttps://security.furybee.org/articles/nis2-dora-european-cyber-regulation/https://security.furybee.org/articles/nis2-dora-european-cyber-regulation/A practical, non-legal overview of NIS2 and DORA scope, obligations, and reporting expectations, mapped to concrete technical controls engineering teams can implement.Mon, 24 Aug 2026 00:00:00 GMTThreat Intelligencenis2doracomplianceregulationrisk-managementeuhttps://security.furybee.org/articles/secrets-in-git-detection-rotation-history/https://security.furybee.org/articles/secrets-in-git-detection-rotation-history/How to catch API keys and passwords before they hit a commit, what to do the moment one leaks, and why rewriting git history never replaces rotating the credential.Mon, 10 Aug 2026 00:00:00 GMTDevSecOpsgitsecrets-managementdevsecopsci-cdgitleakshttps://security.furybee.org/articles/ssh-hardening-certificates-bastions/https://security.furybee.org/articles/ssh-hardening-certificates-bastions/Move past PasswordAuthentication no toward SSH CA certificates, jump-host bastions with session recording, and mesh VPNs that remove SSH from the public internet.Tue, 28 Jul 2026 00:00:00 GMTHardeningsshhardeningbastionwireguardtailscalezero-trusthttps://security.furybee.org/articles/xss-csp-trusted-types-modern-defenses/https://security.furybee.org/articles/xss-csp-trusted-types-modern-defenses/A practical look at reflected, stored, and DOM XSS today, and how nonce-based CSP, strict-dynamic, and Trusted Types close the gaps frameworks leave open.Tue, 14 Jul 2026 00:00:00 GMTPentestxsscsptrusted-typesweb-securityfrontend-securityjavascripthttps://security.furybee.org/articles/threat-modeling-stride-practical/https://security.furybee.org/articles/threat-modeling-stride-practical/Apply the STRIDE framework to a realistic Docker Compose stack (proxy, web app, Postgres, Redis, object storage) with a data-flow diagram and a mitigation table.Wed, 01 Jul 2026 00:00:00 GMTDevSecOpsthreat-modelingstridedevsecopsarchitecture-securityrisk-assessmenthttps://security.furybee.org/articles/reverse-proxy-hardening-traefik-nginx/https://security.furybee.org/articles/reverse-proxy-hardening-traefik-nginx/Concrete Traefik and Nginx configuration for security headers, rate limiting, hop-by-hop header stripping, trusted proxy chains, and the Basic-vs-Bearer auth conflict.Wed, 17 Jun 2026 00:00:00 GMTHardeningreverse-proxytraefiknginxhardeninghttp-headersrate-limitinghttps://security.furybee.org/articles/software-supply-chain-sbom-sigstore-lockfiles/https://security.furybee.org/articles/software-supply-chain-sbom-sigstore-lockfiles/How typosquatting, dependency confusion, and lockfile tampering compromise builds, and how SBOMs, Sigstore signing, and SLSA-aligned CI pinning stop them.Thu, 04 Jun 2026 00:00:00 GMTDevSecOpssupply-chainsbomsigstoredevsecopsci-cddependency-securityhttps://security.furybee.org/articles/jwt-security-algorithm-confusion-validation/https://security.furybee.org/articles/jwt-security-algorithm-confusion-validation/How JWT auth fails in practice: alg-none, RS256-to-HS256 confusion, kid and jku injection, weak secrets, and a hardened validator you can copy in Node and Python.Wed, 20 May 2026 00:00:00 GMTAuthenticationjwtauthenticationjwkstoken-securityapi-securitycryptographyhttps://security.furybee.org/articles/ssrf-server-side-request-forgery/https://security.furybee.org/articles/ssrf-server-side-request-forgery/A practical guide to server-side request forgery: blind and non-blind SSRF, cloud metadata theft, DNS rebinding, and the allowlist-based defenses that actually hold up.Thu, 07 May 2026 00:00:00 GMTPentestssrfcloud-securityweb-securitynetwork-securityinput-validationpentesthttps://security.furybee.org/articles/mcp-security-malicious-tools/https://security.furybee.org/articles/mcp-security-malicious-tools/Model Context Protocol (MCP) enables AI agents to call external tools and integrations. Learn how attackers exploit MCP, malicious tool injection vectors, and defensive patterns to sandbox agent tooling.Sat, 25 Apr 2026 00:00:00 GMTAIaimcpagentstool-securitysupply-chainsandboxhttps://security.furybee.org/articles/ddos-attacks-prevention-mitigation/https://security.furybee.org/articles/ddos-attacks-prevention-mitigation/Dive into the world of Distributed Denial-of-Service (DDoS) attacks, understand their mechanisms, and explore effective prevention techniques and mitigation strategies to safeguard your digital infrastructure.Mon, 16 Feb 2026 00:00:00 GMTNetworkddosnetwork-securitycyber-attacksmitigationpreventionhttps://security.furybee.org/articles/iso-27001-certification/https://security.furybee.org/articles/iso-27001-certification/Explore ISO 27001 certification, understanding its importance, the process, key controls, and benefits for robust information security management.Mon, 16 Feb 2026 00:00:00 GMTHardeningISO 27001Information SecurityCybersecurityCertificationRisk Managementhttps://security.furybee.org/articles/serverless-security-challenges-best-practices/https://security.furybee.org/articles/serverless-security-challenges-best-practices/Explore the unique security challenges of serverless architectures (AWS Lambda, Azure Functions, Google Cloud Functions) and learn best practices for building robust and secure serverless applications.Mon, 16 Feb 2026 00:00:00 GMTDevSecOpsserverlesscloud-securityaws-lambdaazure-functionsgoogle-cloud-functionssecurity-best-practiceshttps://security.furybee.org/articles/ai-supply-chain-attacks/https://security.furybee.org/articles/ai-supply-chain-attacks/Understanding supply chain risks in AI ecosystems — from poisoned training data to malicious plugins and compromised model weights.Mon, 02 Feb 2026 00:00:00 GMTAIaisupply-chainpluginsmodelstrustsecurityhttps://security.furybee.org/articles/ai-agent-monitoring/https://security.furybee.org/articles/ai-agent-monitoring/How to monitor what your AI agent is doing in real-time. Set up logging, action auditing, and alerts for suspicious behavior.Sun, 01 Feb 2026 00:00:00 GMTAIaimonitoringloggingauditagentsobservabilityhttps://security.furybee.org/articles/llm-data-privacy/https://security.furybee.org/articles/llm-data-privacy/How to protect your personal data when using AI assistants. Understanding data flows, local vs cloud models, and privacy-first AI configurations.Wed, 28 Jan 2026 00:00:00 GMTAIaiprivacyllmdata-protectiongdprself-hostedhttps://security.furybee.org/articles/prompt-injection-attacks/https://security.furybee.org/articles/prompt-injection-attacks/Understanding prompt injection, jailbreaks, and indirect prompt injection attacks against LLM-powered applications. Defense strategies and real-world examples.Sun, 25 Jan 2026 00:00:00 GMTAIaiprompt-injectionllmjailbreakowaspsecurityhttps://security.furybee.org/articles/securing-ai-agents/https://security.furybee.org/articles/securing-ai-agents/How to safely deploy AI agents like OpenClaw with minimal permissions, sandboxing, and proper access controls. A practical guide to AI agent security.Tue, 20 Jan 2026 00:00:00 GMTAIaillmagentsleast-privilegeopenclawsecurityhttps://security.furybee.org/articles/secure-coding-practices/https://security.furybee.org/articles/secure-coding-practices/Essential secure coding techniques every developer should know — input validation, authentication, encryption, and avoiding the most common vulnerabilities.Tue, 18 Nov 2025 00:00:00 GMTDevSecOpssecure-codingowaspdevelopmentbest-practicesappsechttps://security.furybee.org/articles/mobile-app-security-testing/https://security.furybee.org/articles/mobile-app-security-testing/A practical guide to mobile application security testing — from setting up your lab to finding vulnerabilities in Android and iOS apps.Wed, 22 Oct 2025 00:00:00 GMTMobile Securitymobileandroidiospentestingapkipahttps://security.furybee.org/articles/malware-analysis-basics/https://security.furybee.org/articles/malware-analysis-basics/A beginner's guide to malware analysis — setting up a safe lab, static analysis, dynamic analysis, and identifying malicious behavior without getting infected.Fri, 05 Sep 2025 00:00:00 GMTToolsmalwarereverse-engineeringforensicsanalysissandboxhttps://security.furybee.org/articles/aws-security-misconfigurations/https://security.furybee.org/articles/aws-security-misconfigurations/The most dangerous AWS misconfigurations attackers exploit — from public S3 buckets to overprivileged IAM roles. Learn to find and fix them before attackers do.Tue, 12 Aug 2025 00:00:00 GMTHardeningawscloud-securitys3iammisconfigurationhttps://security.furybee.org/articles/jailbreaking-ai-agents/https://security.furybee.org/articles/jailbreaking-ai-agents/Explore how adversaries bypass safety guardrails in AI agents through prompt injection, context manipulation, and multi-turn exploits — and how to defend against them.Thu, 10 Jul 2025 00:00:00 GMTAI Securityaijailbreakingprompt-injectionllmred-teamingagentshttps://security.furybee.org/articles/zero-knowledge-proofs/https://security.furybee.org/articles/zero-knowledge-proofs/A deep dive into zero-knowledge proofs — the cryptographic primitive that lets you prove you know a secret without revealing it. From theory to zkSNARKs and real-world applications.Wed, 09 Jul 2025 00:00:00 GMTCryptographyzkpcryptographyzero-knowledgezksnarksprivacyblockchainhttps://security.furybee.org/articles/modern-osint-tools/https://security.furybee.org/articles/modern-osint-tools/A comprehensive guide to open-source intelligence gathering tools — from domain recon and social media analysis to geolocation and dark web monitoring.Tue, 08 Jul 2025 00:00:00 GMTReconnaissanceosintreconnaissanceintelligencetoolsinvestigationsocial-engineeringhttps://security.furybee.org/articles/passkeys-vs-passwords/https://security.furybee.org/articles/passkeys-vs-passwords/Why passkeys are replacing passwords — how FIDO2/WebAuthn works, the security advantages, implementation pitfalls, and what the transition actually looks like.Mon, 07 Jul 2025 00:00:00 GMTAuthenticationpasskeyspasswordsfido2webauthnauthenticationsecurityhttps://security.furybee.org/articles/ransomware-as-a-service/https://security.furybee.org/articles/ransomware-as-a-service/How RaaS operations work — affiliate models, initial access brokers, double extortion tactics, and the defensive strategies that actually reduce risk.Sun, 06 Jul 2025 00:00:00 GMTThreat Intelligenceransomwareraasthreat-intelligencemalwareincident-responsecybercrimehttps://security.furybee.org/articles/securing-smartphones-high-risk-zones/https://security.furybee.org/articles/securing-smartphones-high-risk-zones/A field guide to hardening your mobile device before entering hostile environments — border crossings, protests, conflict zones, and surveillance-heavy regions.Sat, 05 Jul 2025 00:00:00 GMTMobile Securitymobilesmartphoneopsecprivacytravel-securityencryptionhttps://security.furybee.org/articles/ethical-wifi-pentesting/https://security.furybee.org/articles/ethical-wifi-pentesting/A hands-on guide to wireless network penetration testing — monitoring, cracking WPA2/WPA3, evil twin attacks, and client-side exploitation, all within legal and ethical boundaries.Fri, 04 Jul 2025 00:00:00 GMTPenetration Testingwifipentestingwirelessaircrack-ngwpa2ethical-hackinghttps://security.furybee.org/articles/post-quantum-cryptography/https://security.furybee.org/articles/post-quantum-cryptography/Why quantum computers will break RSA and ECC, what NIST's post-quantum standards look like, and how to start migrating your systems today — before Q-Day arrives.Thu, 03 Jul 2025 00:00:00 GMTCryptographypost-quantumcryptographyquantum-computingnistlatticeencryptionhttps://security.furybee.org/articles/devsecops-integration/https://security.furybee.org/articles/devsecops-integration/How to embed security into every stage of your CI/CD pipeline — from pre-commit hooks to production monitoring, with practical tooling and automation examples.Wed, 02 Jul 2025 00:00:00 GMTDevSecOpsdevsecopscicdsastdastsupply-chainautomationsecurityhttps://security.furybee.org/articles/incident-response-playbook/https://security.furybee.org/articles/incident-response-playbook/A practical guide to handling security incidents — detection, containment, eradication, recovery, and lessons learned. With templates and checklists.Sun, 15 Jun 2025 00:00:00 GMTDevSecOpsincident-responsesocdfirforensicsplaybookhttps://security.furybee.org/articles/kubernetes-security-hardening/https://security.furybee.org/articles/kubernetes-security-hardening/Secure your Kubernetes clusters with practical hardening techniques — RBAC, network policies, pod security, secrets management, and runtime protection.Tue, 20 May 2025 00:00:00 GMTHardeningkubernetesk8scontainerscloud-nativerbachttps://security.furybee.org/articles/api-security-oauth-vulnerabilities/https://security.furybee.org/articles/api-security-oauth-vulnerabilities/Deep dive into OAuth2 and OpenID Connect security flaws — from authorization code interception to token leakage and redirect URI manipulation.Tue, 15 Apr 2025 00:00:00 GMTAuthenticationoauthapi-securityauthenticationtokensoidchttps://security.furybee.org/articles/linux-log-analysis/https://security.furybee.org/articles/linux-log-analysis/Master Linux log analysis for threat detection. Learn to use journalctl, grep, awk, and tools like GoAccess and Fail2Ban for security monitoring.Tue, 15 Apr 2025 00:00:00 GMTHardeninglinuxlogsmonitoringjournalctlforensicshttps://security.furybee.org/articles/password-cracking-hashcat/https://security.furybee.org/articles/password-cracking-hashcat/Learn how Hashcat works, common attack modes, and how to audit password strength. Includes practical examples with different hash types.Tue, 01 Apr 2025 00:00:00 GMTPentesthashcatpasswordcrackinghashingpentesthttps://security.furybee.org/articles/vpn-protocols-compared/https://security.furybee.org/articles/vpn-protocols-compared/An in-depth comparison of modern VPN protocols — performance, security, configuration, and when to use each one.Thu, 20 Mar 2025 00:00:00 GMTPrivacyvpnwireguardopenvpnipsecprivacyhttps://security.furybee.org/articles/social-engineering-phishing-detection/https://security.furybee.org/articles/social-engineering-phishing-detection/Understand how attackers manipulate human psychology to bypass technical controls. Learn to identify phishing campaigns and build human firewalls.Mon, 10 Mar 2025 00:00:00 GMTThreat Intelligencephishingsocial-engineeringawarenessemail-securityhuman-factorhttps://security.furybee.org/articles/sql-injection-prevention/https://security.furybee.org/articles/sql-injection-prevention/A deep dive into SQL injection attacks — how they work, common techniques, and how to protect your applications with parameterized queries and input validation.Mon, 10 Mar 2025 00:00:00 GMTPentestsql-injectionweb-securityowasppentestdatabasehttps://security.furybee.org/articles/wireshark-network-analysis/https://security.furybee.org/articles/wireshark-network-analysis/Master Wireshark for capturing and analyzing network traffic. Learn filters, protocol dissection, and how to spot suspicious activity.Sat, 01 Mar 2025 00:00:00 GMTNetworkwiresharknetworktraffic-analysispacketsforensicshttps://security.furybee.org/articles/docker-security-best-practices/https://security.furybee.org/articles/docker-security-best-practices/A comprehensive guide to securing Docker containers, from image scanning to runtime protection and network isolation.Sat, 15 Feb 2025 00:00:00 GMTHardeningdockercontainershardeningdevopssecurityhttps://security.furybee.org/articles/web-application-firewalls/https://security.furybee.org/articles/web-application-firewalls/Learn how Web Application Firewalls work, how to configure ModSecurity and cloud-based WAFs, and best practices for protecting web applications.Mon, 10 Feb 2025 00:00:00 GMTNetworkwafweb-securitymodsecurityowaspfirewallhttps://security.furybee.org/articles/introduction-nmap/https://security.furybee.org/articles/introduction-nmap/Learn how to use Nmap to discover hosts, scan ports, and identify services running on your network.Sat, 01 Feb 2025 00:00:00 GMTNetworknmapnetworkscanpentestreconnaissancehttps://security.furybee.org/articles/bases-chiffrement-rsa-aes/https://security.furybee.org/articles/bases-chiffrement-rsa-aes/An introduction to the most widely used encryption algorithms. Understand the difference between symmetric and asymmetric encryption.Mon, 20 Jan 2025 00:00:00 GMTCryptographycryptographyrsaaesencryptionsecurityhttps://security.furybee.org/articles/securiser-serveur-linux/https://security.furybee.org/articles/securiser-serveur-linux/A complete guide to hardening your Linux server security, from SSH configuration to firewall setup and user management.Wed, 15 Jan 2025 00:00:00 GMTHardeninglinuxserversshfirewallhardening