Three Next.js edge-vs-node desyncs chained: the nxtP query prefix, duplicate-cookie precedence, and a middleware matcher blind to assetPrefix
Writeup for Weird config updater from NDIAS Automotive/IoT CTF 2026. A ZIP parser-differential between the validation and extraction paths lets a debug config slip through a release-only check.
Writeup for Glotq from LA CTF 2026. A Web challenge involving Go JSON vs YAML parser differentials.
