Reduce your exposure to AJAX threats
601472
Three-step guide Fundamentally, there's nothing terribly new about the problems posed by Asynchronous JavaScript and XML (AJAX) when it comes to security, we just need to apply some good old security principles to this new technology.â¦
86222
In brief Exploit circulating for unpatched vuln
56130
Users should be wary of pressing the 'click here to remove' link on spam messages because it serves to confirm to spammers that junk mail messages are being read.
121116
XSS marks the spot Think you've protected your web applications from cross-site scripting (XSS) vulnerabilities? The odds are against you. Roughly 90 per cent of web applications have this problem, and it's getting worse as web applications and web services share more and more data.â¦
43324
Botnet surprise A critical vulnerability has been identified in Adobe's Acrobat and Reader software which affects Internet Explorer users.â¦
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
701997
Beta search app creates vulnerabilities that may threaten your data's security.
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.
189807
Browser flaw may leave you vulnerable to phishing attacks.
648071
Spammers exploit your Achillesâ heel (or other body part).
320458
Web servers may be vulnerable to attack, security company warns.
147647
Do you have any suggestions for individuals and small businesses to combat spam?
431743
Worldwide spending on securing Web content is literally the hottest IT market today. With Web-based threats growing almost exponentially, IT and network managers are struggling mightily to stave off disaster while still letting employees reap the many benefits of the Web. The Webcast Barbarians At The Gate: Why Web Filtering Is So Hot, dives into the sources of the trouble while offering common-sense approaches to a secure Internet computing strategy.
691931
Several major websites are brought down by the largest denial-of-service attacks ever staged. Compiled by Tony Long.
557628
Joshua Eichorn, being the generous soul that he is, is offering in his latest post to answer any Ajax questions his readers might want to know about.    Have you wondered whats the easiest way to submit a form using AJAX, what the status of HTML_AJAX development is, or what is covered in Understanding AJAX?   Well nows your chance.    To get your question(s) in, just submit them as a comment on this post and he'll come back in a few days with the answers.
758956
Hole could allow remote attackers to access your local search results.
194115
On the PHP Security Blog, there's three new posts that Stefan Esser has written up that demonstrate some of the more destructive uses of Javascript that he's found:  JavaScript/HTML Portscanning and HTTP Auth Bruteforcing HTTP Auth in Firefox with JavaScript JavaScript Scanning and expose_php=On    While the first two are interesting, it's the last of these that most directly applies to PHP. He gives a simple "proof of concept" that checks to see if the embedded image is the correct "size" to be related to a webserver running PHP with the expose_php setting set to "on".