2026-11-15
What is TOCTOU: when the state changes between the check and the use
TOCTOU is a race condition (CWE-367) caused by checking and using a resource as two separate steps, so the state can change in between. The main defense: drop the separate check and make check-and-use one atomic operation. Use file descriptors, not paths; use transactions and locks for databases.