Ayush Bulbule

History often repeats itself in the world of cybersecurity. A decade ago, the Heartbleed vulnerability shook the internet by allowing attackers to "bleed" secrets out of a server’s memory. Fast forward to late 2025, and we are facing a strikingly similar crisis: MongoBleed. On December 28, 2025, details emerged about CVE-2025-14847, a high-severity flaw in MongoDB that is currently being exploited in the wild. If you manage your own database clusters, this is a "stop-everything-and-patch" moment. Here is...

You are trying to log into your Microsoft or Google account. You have zero signal. Your phone is completely offline. Yet, you open your Authenticator app, grab a fresh 6-digit code, type it in, and it works. This creates a paradox: How does the server verify your code if your phone never sent it any data? How do two completely disconnected devices agree on a random number at the exact same second? As engineers, we know it’s not magic, it’s System Design. Specifically, it’s an algorithm called TOTP (Time...

The “Log4Shell” Moment for JavaScript For years, we joked that node_modules was the heaviest object in the universe. Last week, it became the most dangerous. Thumbnail by Gemini CVE-2025–55182, dubbed “React2Shell,” is a maximum severity (CVSS 10.0) vulnerability in React Server Components (RSC). If you use Next.js (App Router) or React 19, you are likely vulnerable by default. Why is this the “Log4Shell” of 2025? Ubiquity: Next.js is the standard for modern React. It is everywhere. Ease: No authenticat...