XSS
A domain we'd never seen before, sb1es.com, popped up in our CSP threat-intel feed recently. It was flagged as a code/exfil hit against a customer site, and it looked like it might be a Magecart skimmer at first glance, so I started investigating. It turns
XSS
Just last week, Dependabot alerted us to CVE-2026-73295, a DOM-based XSS in Material for MkDocs, the theme behind docs.report-uri.com. Dependabot opened the bump for us overnight, so it was a simple enough fix, but I was curious what the impact was. It turns out
JavaScript Integrity Monitoring
Right now, on our own production site, I can tell you the cryptographic fingerprint of every single JavaScript file that executed in a real visitor's browser this month. Not what our build system produced. Not what our CDN thinks it's serving. What actually ran, in the
CSP
No injected <script> tag. Nothing loaded from an attacker-controlled origin. A PHP shell at the end of it. A CSP kills this chain on the login page, and can tell you when someone tries. That's exactly what we're for. WordPress shipped an emergency
ClickFix
A customer forwarded us something last week that has stuck with me. It was a live attack campaign — a good one, in the professional-admiration sense — along with a detailed public write-up dissecting exactly how it worked. The analysis was genuinely impressive. It traced the whole thing from the
White Paper
Passkeys are one of the best improvements to online security in a long time. They are designed to replace passwords with a safer, easier way to sign in. That means no more reused passwords, much less risk from phishing emails, and far better protection against attackers trying stolen login details