I’ve been hunting access control bugs for over a decade, and let me tell you - they’re everywhere. When OWASP moved broken access control to #1 in 2025 and merged SSRF into this category, I wasn’t surprised. I was relieved that the security community finally caught up to what I’ve been seeing in the wild. 94% of applications tested have broken access control issues. That’s not a typo - it’s a security apocalypse hiding in plain sight. ...
I’ve been working with the OWASP Top 10 for years, and the 2025 update just dropped some major changes that every developer needs to understand. Supply chain attacks finally made it into the top 10 (as A03), and honestly, it’s about time. I’ve been seeing these attacks destroy companies for the past few years. Here’s the thing about OWASP Top 10 2025: it’s not just updating the old list - it’s completely rethinking modern threats. Security misconfiguration jumped from #5 to #2, and they merged SSRF into broken access control because that’s how attackers actually chain these vulnerabilities together. ...