Top 10 web hacking techniques of 2018

Summary: PortSwigger Research published its Top 10 web hacking techniques of 2018, selected by a panel of James Kettle, Nicolas Grégoire, Soroush Dalili and Filedescriptor from 59 nominations narrowed by community vote to 15 finalists. Orange Tsai took the top spot for research on path validation flaws affecting frameworks, standalone webservers and reverse proxies, followed by James Kettle's work on poisoning web caches via obscure HTTP headers.
Why it matters: The winning entry showed that path validation flaws in frameworks, standalone webservers and reverse proxies alike could be twisted into consistently severe results - a reminder that the components you assume are hardened may share the same class of defect.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026