Unserialize Session Allows $47M Bank Transfer Hack?!

UNSERIALIZE APOCALYPSE! Session fixation + unserialize() = REMOTE CODE EXECUTION! Banking app backdoor installed! $47M transferred to offshore accounts! Banking license REVOKED! CTO ARRESTED!

#php #phpdisaster #unserialize #remotecodeexecution #sessionfixation #bankinghack #productionbug #phpshorts #phpwtf #$47mstolen #careerending #criminalcharges

https://www.youtube.com/watch?v=4KkePjaeFq0

Unserialize Session Allows 47M Bank Transfer Hack?! #sessionfixation

YouTube

One DELETE Cascades To 3.5 MILLION Rows?!

PRODUCTION APOCALYPSE! Deleted ONE user and CASCADE deleted 3.5 MILLION rows across 4 tables! Orders, payments, everything GONE! This is the scariest SQL behavior! Watch this nightmare!

#sql #sqldisaster #cascadedelete #foreignkey #productionbug #dataloss #sqlfails #massdeletion #sqlshorts #databasedisaster #sqlwtf #cascadenightmare

https://www.youtube.com/watch?v=pE_OMbOia_w

One DELETE Cascades To 3.5 MILLION Rows?! #massdeletion

YouTube

Finally Block Overwrites Return Authorizing ALL Payments?!

FINALLY DISASTER! finally return OVERWRITES try return! Large payment protection disabled! 847 fraudulent $9,999 charges! $8.4M fraud! Payment processor TERMINATED contract! CTO RESIGNED!

#python #pythondisaster #finallyblock #returnoverwrite #paymentfraud #productionbug #pythonshorts #pythonwtf #authorizationbypass #careerending #fraudprotection #exceptionhandling

https://www.youtube.com/watch?v=JpK1RmtNbY0

Finally Block Overwrites Return Authorizing ALL Payments?! #authorizationbypass

YouTube

Type Juggling 0==Admin Grants 847 Users ADMIN ACCESS?!

TYPE JUGGLING DISASTER! 0=='admin' returns TRUE! Password check BYPASSED! 847 users got admin access! Downloaded 2.3M customer records! $12.3M data breach lawsuit! CTO FIRED!

#php #phpdisaster #typejuggling #authenticationbypass #securitybreach #adminaccess #productionbug #phpshorts #phpwtf #0equalsadmin #careerending #databreach

https://www.youtube.com/watch?v=uh7YHqXPfVo

Type Juggling 0Admin Grants 847 Users ADMIN ACCESS?! #databreach

YouTube

Decorator Order Executes Route BEFORE Auth Check?!

DECORATOR DISASTER! Apply bottom-to-top! Route runs BEFORE auth! Non-admin deletes 847 users! Cannot recover! $4.7M data loss! €2.7M GDPR fine! Security team FIRED!

#python #pythondisaster #decoratororder #authenticationbypass #routesecurity #productionbug #pythonshorts #pythonwtf #adminaccess #careerending #gdpr #flask

https://www.youtube.com/watch?v=8hBZoqogJP0

Decorator Order Executes Route BEFORE Auth Check?! #Flask

YouTube

File Get Contents Loads 2GB Crashing 47 Web Servers?!

MEMORY EXPLOSION! file_get_contents() loads ENTIRE 2GB file into RAM! 47 web servers CRASHED! Tax deadline missed! 12K users disconnected! $12M class action lawsuit! Lead developer FIRED!

#php #phpdisaster #filegetcontents #memoryexhaustion #servercrash #taxdeadline #productionbug #phpshorts #phpwtf #outofmemory #careerending #cascadefailure

https://www.youtube.com/watch?v=7mhJQ1u608A

File Get Contents Loads 2GB Crashing 47 Web Servers?! #outofmemory

YouTube

Array Merge RESETS Numeric Keys Destroying 2.3M Order IDs?!

ARRAY_MERGE DISASTER! Numeric keys RESET to 0,1,2,3! Order 1001 becomes 0! Payment records can't match! 2.3M orders lose IDs! $8.7M shipping chaos! Database architect FIRED!

#php #phpdisaster #arraymerge #numerickeys #datacorruption #orderids #productionbug #phpshorts #phpwtf #arraychaos #careerending #keyreset

https://www.youtube.com/watch?v=d99qNe0FXXw

Array Merge RESETS Numeric Keys Destroying 2.3M Order IDs?! #keyreset

YouTube

DELETE Without WHERE Deletes EVERYTHING?!

STOP RIGHT NOW! Forgot WHERE clause in DELETE? Your ENTIRE table is GONE! 10 million users DELETED in production! This is every developer's NIGHTMARE! Watch this disaster!

#sql #sqldisaster #delete #productionbug #sqlfails #codingnightmare #sqlshorts #databasedisaster #careerendingbug #sqlwtf #deletewithoutwhere #dataloss

https://www.youtube.com/watch?v=mTvRVICKxo0

DELETE Without WHERE Deletes EVERYTHING?! #databasedisaster

YouTube

Dict Hash Collision DOS Slows Lookups From 1ms To 47 Seconds?!

HASH COLLISION DISASTER! Attacker crafts colliding keys! Dict becomes linked list! O(1)→O(n) lookup! 47 seconds per request! Complete outage! 470K users logged out! $2.3M lost! Infrastructure FIRED!

#python #pythondisaster #hashcollision #dosattack #dictperformance #productionbug #pythonshorts #pythonwtf #o(n)lookup #careerending #sessionstorage #algorithmiccomplexity

https://www.youtube.com/watch?v=f6WZj-_xj5c

Dict Hash Collision DOS Slows Lookups From 1ms To 47 Seconds?! #pythonwtf

YouTube

Bare Except Catches SystemExit Preventing Graceful Shutdown?!

EXCEPT DISASTER! Bare except swallows SystemExit! Process won't die! Force kill corrupts 2,300 payments! $4.7M phantom charges! Payment team FIRED!

#python #pythondisaster #bareexcept #systemexit #gracefulshutdown #productionbug #pythonshorts #pythonwtf #paymentcorruption #careerending #signalhandling #daemon

https://www.youtube.com/watch?v=fwnRVyhEGqY

Bare Except Catches SystemExit Preventing Graceful Shutdown?! #pythonshorts

YouTube