Web Development

JavaScript, TypeScript, Node.js, React, Vue, Angular, Next.js, Nuxt, Svelte, HTML, CSS, Tailwind CSS, WordPress, WordPress plugin, WordPress theme, WordPress development, WooCommerce, PHP, Laravel, Django, Flask, FastAPI, GraphQL, REST API design, web performance, Core Web Vitals, SEO, web accessibility, WCAG, PWA, web app, frontend, backend, full-stack, Vite, Webpack, npm, pnpm

Page 2

Artificial Intelligence

How the Google Gemini CLI Flaw Turned CI/CD Pipelines into Remote Code Execution Risk

A critical remote code execution (RCE) vulnerability in the Google Gemini CLI and its associated GitHub Action exposed a startling weakness in how AI tooling can interact with developer infrastructure. Rated with the maximum CVSS score of 10.0, the bug allowed unprivileged external actors to execute commands on the machines running CI/CD workflows. This wasn’t a prompt-injection trick against a model; it was an infrastructure-level failure that allowed malicious configuration…

Saugata DattaApr 30, 20264 min read304

Data Breach

Bitwarden CLI Compromised in Supply Chain Attack via GitHub Actions

Socket and other researchers have confirmed that the Bitwarden CLI package published to npm — @bitwarden/cli version 2026.4.0 — was compromised in a supply chain attack that abused a GitHub Action in Bitwarden’s CI/CD pipeline. The malicious release injected a file named bw1.js into the package, exposing tokens, cloud credentials, SSH keys and other sensitive artifacts. While Bitwarden’s Chrome extension, MCP server and other official distribution channels are reported unaffected,…

Saugata DattaApr 24, 20264 min read435

Cybersecurity

How a Flippa Purchase Turned 30+ “Essential Plugin” WordPress Plugins into Backdoor Bait

Last week I encountered a supply-chain incident that felt eerily familiar but much larger in scale. A client’s dashboard had started showing a warning from the WordPress.org Plugins Team about a plugin serving code that could permit unauthorized access. A deeper dive revealed an attacker had quietly weaponized an entire portfolio of plugins—planting a backdoor that lay dormant for months before being activated to serve cloaked SEO spam and redirects.…

Saugata DattaApr 14, 20266 min read470

Cybersecurity

Critical Flaw in User Registration Membership Plugin (CVE-2026-1492) Lets Attackers Bypass WordPress Authentication

A newly disclosed vulnerability in a popular WordPress plugin can allow attackers to log in as administrators without a username or password. Tracked as CVE-2026-1492 and carrying a CVSS v4.0 score of 9.8, the flaw affects all versions of the User Registration Membership plugin up through 5.1.2. The issue was documented in early March 2026 by CYFIRMA researchers and represents an urgent risk for site owners who rely on the…

Saugata DattaApr 13, 20263 min read535

Cybersecurity

Critical RCE in Ninja Forms File Upload Exposes ~50,000 WordPress Sites

A recently disclosed vulnerability in the popular Ninja Forms “File Upload” addon has placed roughly 50,000 WordPress sites at risk of full takeover. Tracked as CVE-2026-0740 and carrying a CVSS score of 9.8, the flaw allows unauthenticated arbitrary file uploads — a straightforward path to remote code execution (RCE) for attackers. Site owners who rely on the affected plugin must act immediately to patch and inspect their environments. What happened…

Saugata DattaApr 7, 20264 min read531

Web Development

Supply-chain alert: axios NPM package poisoned to deliver WAVESHAPER.V2 backdoor

A high-risk software supply chain attack has poisoned widely used axios npm releases, turning routine installs into a cross-platform compromise. Developers, CI/CD systems, and production pipelines that pulled the tainted axios versions (1.14.1 and 0.30.4) risked silently receiving a multi-stage backdoor that targeted Windows, macOS, and Linux hosts. Because axios sits deep in many dependency trees, a single malicious release can reach far beyond direct consumers — affecting developer laptops,…

Saugata DattaApr 1, 20264 min read396

Artificial Intelligence

Introducing the Azure Skills Plugin: Practical Azure Workflows for Coding Agents

The Azure Skills Plugin brings curated Azure expertise and an execution layer together so coding agents can do more than offer generic guidance. Rather than just suggesting commands or linking to documentation, the plugin packages decision logic (skills) and structured tools (MCP servers) so agents can reason about workflows and, when appropriate, run actions against real Azure resources. What the plugin is The plugin is a single install that combines…

Saugata DattaMar 10, 20264 min read698

Cybersecurity

Admin Account Backdoor: Critical Privilege-Flaw in WordPress User Registration Plugin (CVE-2026-1492)

A critical security flaw in a widely used WordPress membership plugin has made it trivially simple for unauthenticated attackers to create administrator accounts and seize control of affected sites. The vulnerability, tracked as CVE-2026-1492, exposes a systemic weakness in how the plugin handled role assignment during user registration. This post summarizes what happened, who discovered it, the immediate risks, and the concrete steps site owners should take now. What the…

Saugata DattaMar 6, 20263 min read829

AWS

Migrated this blog to Amazon LightSail from GoDaddy

Finally, I managed to migrate my blog from GoDaddy to Amazon Lightsail, and everything looks good so far. Thanks to Amazon Lightsail for providing a static public IP (34.198.110.82). It's really simple to migrate your blogs from any other hosting Amazon Lightsail, details information can be found here. They have very attractive pricing, which is one of the reason I moved from GoDaddy to Amazon (recently GoDaddy started charging additional…

Saugata DattaFeb 20, 20171 min read7.6K

Free Tools: IP, DNS, SSL