Bypassing WAF via Charset Confusion: The Story of CVE-2026-21876 | DevSense
Discover how CVE-2026-21876 allows attackers to bypass the OWASP ModSecurity Core Rule Set (CRS) using multipart charset confusion and variable overwriting in rule 922110.
Web Security
Attack mechanics and defenses for PHP backends: XSS, SSRF, file uploads, WAF bypasses and infrastructure hardening.
-
-
Advanced File Upload Attacks: Bypass Techniques and Secure Defenses
A comprehensive developer guide on advanced file upload vulnerabilities, including MIME bypass, polyglot images, Zip Slip, SVG XSS, PDF SSRF, and secure Laravel implementations.
-
File Upload Vulnerabilities: Bypassing Filters to Remote Code Execution (RCE) | DevSense
Master the mechanics of secure file uploads. Learn how attackers bypass client-side checks, exploit extension blacklists, override web server configurations, and how to write secure Laravel code.
-
Effective XSS Vulnerability Hunting: From alert() to RCE | DevSense
Master the art of finding and exploiting Cross-Site Scripting (XSS) vulnerabilities. Learn how to build universal payloads, bypass filters, and escalate XSS to RCE with real-world Bug Bounty cases.
-
Server & Infrastructure Hardening: Security Headers, TLS, Rate Limiting, and Secret Management | DevSense
Hardening your web server and application infrastructure. Learn how to configure HTTP security headers, TLS ciphers, rate limiters, secure secrets, and database isolation.
-
Web Application Vulnerabilities & Mitigations: SQLi, Command Injection, XSS, CSRF & IDOR | DevSense
Protect your PHP applications from common web vulnerabilities. Learn how to prevent SQL Injection, Command Injection, XSS, CSRF, and IDOR with secure code examples.
-
SSRF & Secure File Uploads: Preventing Server-Side Request Forgery and Remote Code Execution | DevSense
Secure your backend infrastructure. Learn how to prevent Server-Side Request Forgery (SSRF) and malicious file uploads leading to Remote Code Execution (RCE).