hacking

Immutable Strings in Java – Are Your Secrets Still Safe?

—

Java programmers might not be aware their secrets could be floating around in system memory long after it’s assumed those secrets have been removed. The problem is a combination of immutability and garbage collection in Java. Our most recent post explores the unpredictability of Java garbage collection and the implications that has for secrets in code. We developed a simple proof of concept designed to measured these “secret ghosts” and demonstrate how to avoid them.

Production Security, Not That Kind

—

The Include Security team takes a foray into the world of audio production equipment in our latest blog post. We look under the hood of a professional-grade audio mixer to explore its security profile, consider how its functionality could be leveraged by an attacker in a real world setting, and develop a proof-of-concept exploit to demonstrate quick n’ easy privilege escalation.

LLMs in Applications – Understanding and Scoping Attack Surface

—

In this post we consider how to think about the attack surface of applications leveraging LLMs and how that impacts the scoping process when assessing those applications. We discuss why scoping matters, important points to consider when mapping out the LLM-associated attack surface, and conclude with architectural tips for developers implementing LLMs within their applications.

Cross-Site WebSocket Hijacking Exploitation in 2025

—

Include Security’s latest blog post covers Cross-Site WebSocket Hijacking and how modern browser security features do (or don’t) protect users. We discuss Total Cookie Protection in Firefox, Private Network Access in Chrome, and review the SameSite attribute’s role in CSWH attacks. The post includes a few brief case studies based on situations encountered during real world testing, in addition to a simple test site that can be hosted by readers to explore each of the vulnerability conditions.

Memory Corruption in Delphi

—

In our team’s latest blog post, we build a few examples that showcase ways in which memory corruption vulnerabilities could manifest in Delphi code despite being included in a list of “memory safe” languages within a paper published by the NSA. We cover how compiler flags and dangerous system library routines could affect memory safety while demonstrating Delphi stack/heap-based overflow examples and conclude with a few tips for developers to avoid introducing memory vulnerabilities in their Delphi code.