This is a weekly series where you can get caught up on recent events relevant to open source security, with an initial focus on WordPress security.
This series is brought to you by Patchstack and your host Robert. I look forward to helping keep you regularly up to date on open source security issues here at the Patchstack weekly Update.
In this episode we want to say two things: 1) Happy new year and 2) rotate your passwords! Rotating your passwords regularly is a key security practice. We feel it’s important to stress this in light of the latest news from the LastPass security breach – we now know that attackers did gain access to…
Last week we confirmed that ChatGPT can write basic WordPress plugins – but should you let it? Does AI write safe code? Can it detect vulnerabilities? Tune in to this year’s last episode of Patchstack Weekly to find out what the recent advances in AI mean for the future of web development.
This week’s knowledge share is about a recent influx of patched security bugs affecting a single vendor. Don’t panic though – the bugs are low-risk. The noteworthy part is the number of products affected by the same bug. Stay tuned for this weekly knowledge share where Robert explains why one vendor has multiple products affected…
Recently LastPass reported a secondary security incident that occurred months after an initial break-in. We applaud their honesty and transparency in handling the matter – this is a great example of how to handle any security incident! LastPass team’s investigation concluded that this recent issue – of unexpected access to a third party service –…
Knowing where to look is the key to finding what you’re looking for. For security bugs, it is essential. In this week’s knowledge share, Robert will teach you the basic process of finding security bugs using static code analysis – also known as SAST.
This week’s knowledge share is about the security concern caused when software has been abandoned or has reached its end of life (EOL). To that point, Robert will also talk about the surprising number of plugins that were recently removed from WordPress.org for being abandoned.
This week’s knowledge share is about the PHP world’s smallest security bug. We say smallest because it is one character long. You may wonder how much trouble could one character possibly cause? Stick around for this week’s knowledge share where Robert will be talking about type juggling in PHP.
Cross-site scripting is something we talk about a lot – but what is it exactly? Cross-site scripting – or XSS – is a prevalent threat. In fact, we add about 50 (!) new XSS vulnerabilities to our database every month. So hop on in to learn about this all-too-common vulnerability with Robert and see what…
Hey all – today we’re going phishing! If that made you start packing for the trip with excitement, then you probably misread the word. “Phishing”, is when a seemingly familiar or trustworthy website is actually a fake, set up to capture your data or sensitive information. In this episode, Robert explains how an open redirect…
Asking a complete stranger to help you with a website emergency can make things from bad to worse. Every website owner should have a trusted emergency contact at hand when things get dicey. But how do you find those people? How do you know who to trust?
“Never trust user input” – this is security’s golden rule. So it’s a great thing OWASP ZAP has tools that can show you how much data in a web app is controlled by the browser – and therefore also by the user. Robert explains how to use those tools to uncover the hidden risk.
In this week’s knowledge share Robert will continue to share with you some tips and tricks with OWASP ZAP. He’ll go over ZAP’s HUD – or heads-up display – so you can get an idea of what it can be used for. In other news, popular online news site Fast Company suffered a major attack…
We should probably start with “what the hell is it?” Well, OWASP ZAP is an open-source web application security tool written by developers, for developers. It is meant for those who want to get their hands dirty testing their web applications. Of course, it also works great for security researchers and anyone interested in learning…
We skipped an episode last week as Robert took a drive down to WordCamp US in San Diego – but this week he’s back to tell you all about it! He’ll also dig into a critical vulnerability found in the premium WPGateway plugin, which is unfortunately already being used for attacks. However, as always, we…
The WordPress 6.0.2 security release made a splash in the news last week with three vulnerabilities patched with it – but what were they? Should you be worried? Let’s get cozy with Robert as he runs us through the now patched vulnerabilities, and explains why none of them is an immediate risk. Or as he…
