Keeping applications and the data in them safe: common web vulnerabilities, testing and scanning, data protection obligations, and responding to critical flaws.
6 articles
Security8 min read
Node.js 22, 24, and 26 received fixes for ten vulnerabilities, four of them rated high, including a Brotli decoder bug that can lead to remote code execution. Which issues matter for typical web applications, which versions to install, and how to upgrade servers, containers, and managed platforms.
Security9 min read
PHP2Shell is a pair of critical flaws in PHP itself that allow unauthenticated remote code execution. What is affected, how to check the version your web server really runs, how to patch per environment, what to do if you cannot patch today, and how to check for compromise.
Security10 min read
What Law No. 27 of 2022 asks of the software itself: general and specific data, controllers and processors, lawful basis and consent records, masking NIK in logs, retention jobs, data subject requests, the 3 x 24 hour breach notice, and where to start.
Security9 min read
A practical guide to penetration testing: how it differs from a vulnerability scan, black, grey, and white box testing, what to put in scope, when you need one, how an engagement runs, how to read the report, and how to choose a vendor.
Security10 min read
The ten risk categories in the 2025 edition of the OWASP Top 10, what each looks like in a real business application, how to prevent it in Laravel, Django, or Node.js projects, and how to build these checks into the development process.
Security10 min read
How to use the free Qualys Community Edition to scan a web application and servers for vulnerabilities: what the free tier includes, preparing a safe scan, authentication, discovery and vulnerability scans, reading results, and its limits.
Tell us about your project, what you need to build, and the challenges you are facing. We can discuss the technical approach, scope, timeline, and estimated cost.
Start a conversation