Diego Diaz - DEV Community

Diego Diaz

Jul 15

Next.js API Security Vulnerabilities: The 10 Most Common Findings (2026)

#pentest101 #indie #vibecoding

6 min read

Diego Diaz

Jul 15

¿Qué es el Pentesting? Guía Completa 2026 para Startups

#pentest101 #indie

5 min read

Diego Diaz

Jul 15

Supabase Security Checklist 2026: 15 Checks Esenciales para Producción

#pentest101 #indie #prelaunch

5 min read

Diego Diaz

Jul 15

Startup Security Audit Checklist 2026: 50 Checks Before You Ship

#pentest101 #indie #prelaunch

5 min read

Diego Diaz

Jul 15

CVE-2026-32202: APT28 Exploits Incomplete Windows Patch to Steal NTLM Hashes Zero-Click

#cve202632202 #apt28 #windowssecurity #ntlmhash

3 min read

Diego Diaz

Jul 15

Penetration Testing for Startups in 2026: The Complete Founder's Guide

#pentest101 #indie

8 min read

Diego Diaz

Jul 15

CVE-2026-23918: Apache HTTP/2 Double-Free Flaw Lets Attackers Crash Servers and Potentially Execute Remote Code

#cve202623918 #apachehttpserver #http2 #remotecodeexecution

4 min read

Diego Diaz

Jul 15

Ivanti EPMM CVE-2026-6973 RCE Is Under Active Exploit — Patch by Sunday

#cve20266973 #ivantiepmm #rce #cisakev

4 min read

Diego Diaz

Jul 15

I scanned 100 vibe-coded apps. 73 had a BOLA.

#vibecoding #prelaunch #indie

6 min read

Diego Diaz

Jul 15

The 8-item security checklist no one tells indie devs

#prelaunch #indie #pentest101

6 min read

Diego Diaz

Jul 15

Dirty Frag: Chained Linux Kernel Flaws Give Root on Every Major Distribution

#linuxkernel #privilegeescalation #cve202643284 #cve202643500

4 min read

Diego Diaz

Jul 15

How BOLA killed my MVP (and what I wish I'd done before launch)

#indie #breach #pentest101

5 min read

Diego Diaz

Jul 15

Fake OpenAI Repo on Hugging Face Delivered Rust Infostealer to 244,000 Developers

#huggingface #supplychainattack #infostealer #openai

4 min read

Diego Diaz

Jul 15

Two Critical CVEs Hit Hugging Face: TGI DoS (CVE-2026-0599) and LeRobot Unauthenticated RCE (CVE-2026-25874)

#huggingface #cve20260599 #cve202625874 #textgenerationinference

5 min read

Diego Diaz

Jul 15

Exim CVE-2026-45185 — Unauthenticated RCE in the World's Most Deployed Mail Server

#exim #cve202645185 #rce #mailserver

1

3 min read

Diego Diaz

Jul 15

Hackers Used AI to Build a Zero-Day That Bypasses Two-Factor Authentication — Google Stopped It

#aithreats #zeroday #2fabypass #googlegtig

4 min read

Diego Diaz

Jul 15

Mini Shai-Hulud Worm Hits 172 npm Packages — Including TanStack, Mistral AI, and Guardrails AI

#supplychainattack #npmworm #shaihulud #tanstack

3 min read

Diego Diaz

Jul 15

Microsoft Patches 138 Vulnerabilities: Netlogon and DNS RCE Flaws Lead May Update

#microsoft #patchtuesday #cve202641089 #cve202641096

4 min read

Diego Diaz

Jul 15

Hugging Face Double CVE: TGI DoS and LeRobot RCE Expose AI Infrastructure

#huggingface #cve20260599 #cve202625874 #aisecurity

4 min read

Diego Diaz

Jul 14

NGINX Rift: 18-Year-Old Heap Overflow Lets Attackers Hijack One-Third of the Web

#nginx #cve202642945 #rce #supplychain

3 min read

Diego Diaz

Jul 14

PraisonAI Auth Bypass Was Scanned 4 Hours After Disclosure — And It's an AI Agent Framework

#praisonai #cve202644338 #aiagents #authbypass

4 min read

Diego Diaz

Jul 14

Microsoft Patch Tuesday 2026: 622 Fixes Including Two Actively‑Exploited Zero‑Days

#microsoftpatch #zeroday #cve202656155 #sharepoint

2 min read

Diego Diaz

Jul 14

Claw Chain: Four OpenClaw Vulnerabilities Expose 245,000 AI Agent Servers to Data Theft

#openclaw #clawchain #cyera #aiagentsecurity

3 min read

Diego Diaz

Jul 14

Cisco SD-WAN Auth Bypass CVE-2026-20182 Added to CISA KEV — Patch by May 17

#cisco #sdwan #cve202620182 #cisakev

3 min read

Diego Diaz

Jul 14

Microsoft Exchange OWA Zero-Day CVE-2026-42897 Exploited via Crafted Emails

#microsoftexchange #zeroday #cve202642897 #xss

3 min read

Diego Diaz

Jul 14

Turla Upgrades Kazuar Backdoor Into Modular P2P Botnet

#turla #kazuar #apt #p2pbotnet

3 min read

Diego Diaz

Jul 14

Grafana GitHub Token Theft: Codebase Downloaded, Ransom Rejected

#grafana #github #supplychain #tokentheft

3 min read

Diego Diaz

Jul 14

Microsoft Dismantles Fox Tempest: The $9K Malware-Signing Service Behind Ransomware's Trust Exploit

#foxtempest #malwaresigning #ransomware #microsoft

4 min read

Diego Diaz

Jul 14

Nx Console 18.95.0: How a 2.2M-Install VS Code Extension Became a Credential Stealer

#supplychain #vscodeextension #credentialtheft #nxconsole

3 min read

Diego Diaz

Jul 14

TeamPCP Breaches GitHub: 3,800 Internal Repos Exfiltrated via Poisoned VS Code Extension

#githubbreach #teampcp #supplychain #vscodeextension

5

4 min read

Diego Diaz

Jul 14

CVE-2026-9082: Unauthenticated SQL Injection in Drupal Core Lets Attackers Execute Remote Code on PostgreSQL Sites

#drupal #cve20269082 #sqlinjection #rce

5

4 min read

Diego Diaz

Jul 14

Chrome 146 Zero-Days: The Skia and V8 Attack Surface, 2026 Edition

#chrome #zeroday #skia #v8

6 min read

Diego Diaz

Jul 14

AEGIS: Open-Source SOAR for Indie Founders

#aegis #soar #opensource #indie

9 min read

Diego Diaz

Jul 14

Audit a Cursor or v0-Built MVP Before You Launch

#vibecoding #cursor #v0 #mvp

5

8 min read

Diego Diaz

Jul 14

The 2026 Vibe-Coder Security Checklist: 17 Items

#checklist #vibecoding #indie #prelaunch

5

9 min read

Diego Diaz

Jul 14

Cisco Patches CVSS 10.0 Flaw in Secure Workload — Unauthenticated Attackers Could Gain Site Admin via API

#cisco #cve202620223 #cvss10 #restapi

5

4 min read

Diego Diaz

Jul 14

Megalodon: How 5,561 GitHub Repositories Got Backdoored in Six Hours

#githubactions #supplychain #cicdsecurity #devsecops

1

4 min read

Diego Diaz

Jul 14

Crunchyroll Breach: How a Telus Supply-Chain Compromise Let Attackers In — and What to Hunt For

#crunchyroll #supplychain #tellus #breach

5 min read

Diego Diaz

Jul 14

The MCP Confused Deputy: Provenance Gaps, Instruction Injection, and DNS Rebinding in the Model Context Protocol

#mcp #confuseddeputy #promptinjection #dnsrebinding

3

7 min read

Diego Diaz

Jul 14

North Korea's Lazarus Group Deploys RemotePE — A Memory-Only RAT That Leaves Zero Disk Traces

#lazarus #apt #rat #filelessmalware

3 min read

Diego Diaz

Jul 14

CVE-2026-45659: SharePoint RCE Flaw Lets Any Site Member Execute Code Remotely

#cve202645659 #sharepoint #rce #microsoft

4 min read

Diego Diaz

Jul 14

Iran's Nimbus Manticore Deploys AI-Assisted MiniFast Backdoor via Phishing and SEO Poisoning

#nimbusmanticore #minifast #seopoisoning #phishing

4 min read

Diego Diaz

Jul 14

NGINX Rift: CVE-2026-42945 — An 18-Year-Old Heap Overflow Now Under Active Exploitation

#nginx #cve202642945 #rce #heapoverflow

4 min read

Diego Diaz

Jul 13

TrapDoor: 34+ Malicious Packages Hit npm, PyPI, and Crates.io in Coordinated Supply Chain Attack

#supplychain #npm #pypi #crates

4 min read

Diego Diaz

Jul 13

Gitea Container Registry Flaw Left 30,000 Private Image Repositories Wide Open for 4 Years

#cve202627771 #containersecurity #gitea #devops

3

4 min read

Diego Diaz

Jul 13

Free Scan or Full Pentest? A Decision Guide for Founders Shipping a Vibe-Coded MVP

#pentest #freescan #startup #prelaunch

7 min read

Diego Diaz

Jul 13

June 2026 Patch Tuesday: An Actively-Exploited Chrome Zero-Day and a Wormable Windows RCE

#cve202611645 #cve202645657 #patchtuesday #chrome

2 min read

Diego Diaz

Jul 13

CVE-2026-42271: How a Popular AI Gateway Became an RCE Vector — And What to Audit in Your Stack

#cve202642271 #litellm #aigateway #commandinjection

3 min read

Diego Diaz

Jul 13

UNC6508: PRC Spies Exploit REDCap Servers to Infiltrate US Medical Research for 2 Years

#prcespionage #redcap #unc6508 #medicalresearch

3 min read

Diego Diaz

Jul 13

Oracle E-Business Suite CVE‑2026‑46817: Critical Authentication Bypass in Oracle Payments

#oracle #ebs #payments #cve202646817

2 min read

Diego Diaz

Jul 13

Microsoft SharePoint Server Remote Code Execution (CVE‑2026‑45659) Actively Exploited

#sharepoint #cve202645659 #remotecodeexecution #microsoft

3 min read

Diego Diaz

Jul 13

Ubiquiti UniFi Critical Flaws Exposed: CVE-2026-50746 and Companion Vulnerabilities

#cve #ubiquiti #network

3 min read

Diego Diaz

Jul 13

Critical XSS Flaw in Zimbra Classic Web Client Enables Arbitrary Code Execution

#zimbra #xss #emailsecurity #cve

2 min read

Writing Debut