Page 6 - Security/OWASP

Docker Bench Security automatically checks host, daemon and running containers against the CIS Docker Benchmark and produces a structured report within minutes. Reading that output correctly, prioritizing it and wiring it into the CI pipeline turns a one time audit into a continuous security process instead of an ignored PDF file.

SSH is the most important gateway for server access, and also one of the most heavily automated attack targets on the internet. This article shows how key-based authentication with ed25519, disabled root login, fail2ban, and a hardened sshd_config reliably block brute-force attacks, rounded out with bastion host patterns for secure access to production servers.

A hijacked session gives an attacker the same access as a stolen password, often without the actual login mechanism ever being compromised. Solid session security in PHP combines ID regeneration after login, secure cookie flags and server side binding to stable client traits to prevent both fixation and hijacking alike.

Standard Unix permissions do not stop a compromised process from reading everything the running user is allowed to read. Mandatory Access Control adds a second, kernel enforced barrier in front of that. This article compares SELinux and AppArmor, explains label based and path based policy with real examples, and shows how to reliably diagnose a MAC caused permission denied.

Bash ships with a built-in tool for checking whether a TCP port on another host is reachable, through the pseudo file /dev/tcp, with no need for netcat, nmap, or an extra package. For simple reachability checks in monitoring and deployment scripts that is often plenty, but for real security analysis or large network ranges it is the wrong toolset.

Relying on a single universal escaping function puts Magento and Hyvä stores at risk, because HTML, attributes, JavaScript, URLs, and CSS each follow different syntax rules and attack vectors. This article explains why htmlspecialchars alone is not enough, how the Hyvä Escaper class matches the right context, and how Content Security Policy acts as an additional line of defense.

A race condition arises when two or more requests read and modify the same data nearly simultaneously without the application coordinating this shared access, letting an attacker bypass a check that works correctly under single execution by deliberately firing multiple requests at once. Such vulnerabilities are especially tricky because the affected code appears completely bug-free under normal, sequential testing, and the problem only surfaces under deliberately induced, high concurrency.

Rootless Docker lets the Docker daemon and all containers run as a regular user, without root privileges. This considerably reduces the attack surface, but it comes with concrete limitations around privileged ports, volume permissions, and certain network features. Here you will learn when the switch makes sense and when it creates more problems than it solves.

JSON Web Tokens are the modern standard for stateless authentication, yet flawed implementations open the door to attackers. This article walks through the most common pitfalls such as algorithm confusion, unprotected payload data, and insecure storage, and delivers concrete, tested PHP solutions for robust API authentication.

runtimeConfig is built for values that can still change after the build, for example because the same Docker container runs in several environments with different API endpoints. The difference between public and private values directly determines whether a value ends up accidentally exposed as a secret in the client.