Post

@pentesterlab.com

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟬, 𝟮𝟬𝟮𝟲 A great mix of content this week! 🔒 𝗜𝗿𝗼𝗻𝗖𝘂𝗿𝘁𝗮𝗶𝗻: 𝗔 𝗣𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗔𝗜 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗕𝘂𝗶𝗹𝘁 𝗦𝗲𝗰𝘂𝗿𝗲 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗚𝗿𝗼𝘂𝗻𝗱 𝗨𝗽 Niels Provos (from OpenBSD's systrace) is sharing a new tool to sandbox your AI assistant: www.provos.org/p/ironcurtai....

@pentesterlab.com

🚥 𝗺𝗶𝘁𝗺𝗽𝗿𝗼𝘅𝘆 𝗳𝗼𝗿 𝗳𝘂𝗻 𝗮𝗻𝗱 𝗽𝗿𝗼𝗳𝗶𝘁: 𝗜𝗻𝘁𝗲𝗿𝗰𝗲𝗽𝘁𝗶𝗼𝗻 𝗮𝗻𝗱 𝗔𝗻𝗮𝗹𝘆𝘀𝗶𝘀 𝗼𝗳 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗧𝗿𝗮𝗳𝗳𝗶𝗰 A write-up on how to use mitmproxy: www.synacktiv.com/en/publicati....

synacktiv.commitmproxy for fun and profit: Interception and Analysis of Applicationmitmproxy for fun and profit: Interception and Analysis of Application

@pentesterlab.com

✨ 𝗧𝗵𝗲 𝗠𝗖𝗣 𝗔𝘂𝘁𝗵𝗡/𝗭 𝗡𝗶𝗴𝗵𝘁𝗺𝗮𝗿𝗲 A reminder of the mess AuthN/Z with MCP is: blog.doyensec.com/2026/03/05/m....

blog.doyensec.com The MCP AuthN/Z Nightmare · Doyensec's Blog The MCP AuthN/Z Nightmare

@pentesterlab.com

😎 𝗩𝗶𝗯𝗲 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗥𝗮𝗱𝗮𝗿 A cool little project to track the security issues created by vibe coding: vibe-radar-ten.vercel.app.

vibe-radar-ten.vercel.appVibe Security RadarTracking the security cost of vibe coding

8/3/26, 9:01 pm0 reposts1 like

@pentesterlab.com

⛓️‍💥 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗕𝘆𝗽𝗮𝘀𝘀 𝗶𝗻 𝗽𝗮𝗰𝟰𝗷 Another issue with a library leveragining JWT: www.codeant.ai/security-res....

codeant.aiCVE-2026-29000: Critical Auth Bypass in pac4j-jwt: Full PoC Using Only a Public KeyCodeAnt AI found a critical authentication bypass in pac4j-jwt where an attacker can impersonate any user using only the RSA public key. Full PoC and disclosure.