From the 2MNY engineering team

Website Security Articles

General website security articles.

All AI & LLM Security 1 API Security 2 Attack Surface 3 DNS Security 2 HTTP Headers 1 Monitoring 2 OWASP 4 Product Updates 6 Small Business 1 SSL/TLS 1 Supply Chain Security 2 Threat Intelligence 2 Website Security 7 WordPress Security 1

Website Security

Stack Traces Are Free Reconnaissance: What Your Error Pages Teach Attackers

Every production stack trace is a miniature architecture document: framework, version, absolute file paths, class names, database driver, sometimes the query. Attackers harvest error pages on purpose. Here's what each framework's leak looks like, which debug endpoints make it worse, and how detection works without sending a single malicious payload.

2MNY Admin • Oct 13, 2026 • 4 min read

Website Security

Web Cache Deception: When Your CDN Caches a Stranger's Account Page

A victim clicks a link to /account/settings/style.css. The router normalizes the unknown suffix and serves the real account page — but the cache layer, keying on .css, stores the personalized response for everyone. Minutes later the attacker fetches the same URL and receives the victim's cached page. Here's how the attack works, how we prove it safely, and the three-layer defense.

2MNY Admin • Oct 13, 2026 • 4 min read

Website Security

CSV Formula Injection: The Spreadsheet That Opens a Command Prompt

Your export endpoint writes user-controlled strings into CSV cells. When a cell starts with =, @, +, -, or a tab, Excel and friends treat it as code — and a crafted cell can chain DDE into a command prompt on the analyst's machine. Here's the two-sided detection: planted formula cells already present, and the reflection vector that lets attackers plant them — proven without sending a single formula.

2MNY Admin • Oct 13, 2026 • 4 min read

Website Security

CVSS Scores Explained: How Vulnerability Severity Is Really Calculated

Every vulnerability report shows CVSS numbers, but most teams read them wrong. Here's how CVSS v3.1 scores are actually computed, what each metric means, and how to prioritize.

2MNY Admin • Oct 11, 2026 • 5 min read

Website Security

Laravel Security Checklist: 15 Checks Before You Ship

Laravel is secure by default — your configuration usually isn't. This 15-point checklist covers the exposure classes we actually find when scanning Laravel apps in production.

2MNY Admin • Oct 11, 2026 • 5 min read

Website Security

Web Security Trends: October 2026 From a 29,000-Domain Scanning Fleet

Header drift after redesigns, fast-growing AI/LLM exposures, forgotten WordPress installs, and an exploitation window measured in hours — what we actually see scanning 29,000+ domains, and the five fixes that matter most.

2MNY Admin • Oct 09, 2026 • 5 min read

Website Security

Understanding SSL/TLS Certificates: A Complete Guide for Website Owners

SSL certificates are essential for website security. Learn what they are, why they matter, and how to choose the right one for your website.

2MNY Admin • Jul 07, 2026 • 2 min read

Put the reading to work

Run a free scan and see which of the issues we write about are live on your website right now.

Start Free Scan