Top 10 web hacking techniques of 2022

Summary: PortSwigger Research published its 16th annual Top 10 Web Hacking Techniques list for 2022, drawing a record 46 community nominations that were narrowed to 15 finalists and judged by a panel of Nicolas Grégoire, Soroush Dalili, Filedescriptor and James Kettle. The final ten included Psychic Signatures in Java (forging ECDSA signatures using the number 0), worldwide server-side cache poisoning on all Akamai edge nodes, browser-powered desync attacks, and Frans Rosen's account hijacking via dirty dancing in OAuth sign-in flows, which took first place.
Why it matters: The winning entry chains OAuth quirks with low-impact URL-leak gadgets like promiscuous postMessages and third-party XSS - bugs that were previously dismissed as having no significant security impact and so have had years to proliferate across modern SSO stacks.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026