Top 10 web hacking techniques of 2021
Summary: PortSwigger Research published its community-powered Top 10 new web hacking techniques of 2021, drawing on 40 nominated research papers that the infosec community voted down to 15 finalists, with an expert panel of Nicolas Grégoire, Soroush Dalili, Filedescriptor and James Kettle selecting the official list. HTTP request smuggling and parser inconsistency dominated both the nominations and the final ten, and Alex Birsan's Dependency Confusion took the top spot for exploiting package name ambiguity to achieve RCE on numerous major companies and earn well over $100k in bounties.
What you should know: Dependency Confusion earned over $100,000 in bounties by turning package name ambiguity into remote code execution at numerous major companies, and the panel notes discussions and mitigations are still underway - meaning the design and configuration flaws it exposed in major package managers may still sit in your build pipeline.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026