https://palanit.com/blog Research and notes on AI-agent, MCP and application security from PALANIT. en https://palanit.com/blog/palanit-vs-securityheaders-vs-mozilla-observatory https://palanit.com/blog/palanit-vs-securityheaders-vs-mozilla-observatory Fri, 30 Oct 2026 00:00:00 GMT An honest comparison of three free, passive website security scanners — what each one checks, where they overlap, and when to reach for which. https://palanit.com/blog/how-to-get-an-a-plus-security-grade https://palanit.com/blog/how-to-get-an-a-plus-security-grade Fri, 30 Oct 2026 00:00:00 GMT A field guide to a clean website security scan — headers, TLS, email/DNS auth, and exposed files — with a link to the exact fix for every finding. https://palanit.com/blog/email-authentication-spf-dkim-dmarc https://palanit.com/blog/email-authentication-spf-dkim-dmarc Fri, 30 Oct 2026 00:00:00 GMT Stop spoofing with SPF, DKIM, DMARC, plus DNSSEC, CAA, MTA-STS, TLS-RPT and DANE — the records a scanner checks, and how to publish them safely. https://palanit.com/blog/tls-and-certificate-best-practices https://palanit.com/blog/tls-and-certificate-best-practices Fri, 30 Oct 2026 00:00:00 GMT Disable legacy TLS, keep your certificate healthy, serve the full chain, and force HTTPS — the TLS checks a scanner runs and how to pass them. https://palanit.com/blog/security-headers-guide-hsts-csp https://palanit.com/blog/security-headers-guide-hsts-csp Fri, 30 Oct 2026 00:00:00 GMT Set HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy and secure cookies the way a scanner expects — with copy-paste config. https://palanit.com/blog/stop-exposing-files-and-secrets https://palanit.com/blog/stop-exposing-files-and-secrets Fri, 30 Oct 2026 00:00:00 GMT Close off /.git and /.env, drop production source maps, hide version banners, fix mixed content, SRI and permissive CORS before someone else finds them. https://palanit.com/blog/php2shell-cve-2026-109618-explained https://palanit.com/blog/php2shell-cve-2026-109618-explained Sat, 24 Oct 2026 00:00:00 GMT php2shell (CVE-2026-109618 / 109619) turns PHP's file-upload parser into a shell. What's affected, the patched versions, and how to check safely. https://palanit.com/blog/how-to-secure-an-mcp-server-checklist https://palanit.com/blog/how-to-secure-an-mcp-server-checklist Fri, 23 Oct 2026 00:00:00 GMT A concrete checklist for securing an MCP server: pin versions, use TLS, keep secrets out of config, and scan tool descriptions before you ship. https://palanit.com/blog/mcp-tool-poisoning-explained https://palanit.com/blog/mcp-tool-poisoning-explained Thu, 22 Oct 2026 00:00:00 GMT Tool poisoning hides instructions inside an MCP tool's description so your agent obeys the attacker. How the attack works and how to detect it. https://palanit.com/blog/state-of-mcp-security https://palanit.com/blog/state-of-mcp-security Sat, 17 Oct 2026 00:00:00 GMT A static-analysis look at 82 real, public Model Context Protocol configs. 42% had a security finding — and the dominant risk is supply chain, not exotic attacks.