PentesterLab

pentesterlab.comPentesterLab: Learn with our JavaScript Sandbox EscapingThis badge covers JavaScript sandbox escape vulnerabilities. From prototype chain navigation and Function constructor abuse to vm module escapes, static-eval bypasses, real-world CVEs, and advanced pr...

28 Apr

New badge: JavaScript Sandbox Escape! The first 4 labs are live. If you ship anything that evaluates untrusted or model-generated JavaScript, this badge is for you: pentesterlab.com/badges/javas...

flatt.techRemote Command Execution in Google Cloud with Single Directory DeletionIntroduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google. During...

29 Mar

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟯, 𝟮𝟬𝟮𝟲 Only one entry but definitely worth reading! ☁️ 𝗥𝗲𝗺𝗼𝘁𝗲 𝗖𝗼𝗺𝗺𝗮𝗻𝗱 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 𝗶𝗻 𝗚𝗼𝗼𝗴𝗹𝗲 𝗖𝗹𝗼𝘂𝗱 𝘄𝗶𝘁𝗵 𝗦𝗶𝗻𝗴𝗹𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗗𝗲𝗹𝗲𝘁𝗶𝗼𝗻 This one is a real tour de force: flatt.tech/research/pos....

PentesterLab reposted

Dominique Righetto

@righettod.eu

26 Mar

🧑‍🎓 Learning of the day for me, once again thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation). #appsec #appsecurity

xclow3n.github.ioTesting AI for Vulnerability Research: 4 Approaches & Where I Failed | xclow3nTested 4 AI-assisted approaches for finding vulnerabilities over one week. Found real bugs — 14 confirmed vulns in one target in 20 minutes. Also burned time on an approach that found nothing useful. ...

22 Mar

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟮, 𝟮𝟬𝟮𝟲 AI doing research, AI killing CTF 🤖 𝗧𝗲𝘀𝘁𝗶𝗻𝗴 𝗔𝗜 𝗳𝗼𝗿 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝟰 𝗔𝗽𝗽𝗿𝗼𝗮𝗰𝗵𝗲𝘀 & 𝗪𝗵𝗲𝗿𝗲 𝗜 𝗙𝗮𝗶𝗹𝗲𝗱 If you can only read one thing this week, make it this article: xclow3n.github.io/post/7.

🐧 𝗦𝗮𝘀𝗵𝗶𝗸𝗼 Sashiko is an agentic Linux kernel code review system that monitors public mailing lists to thoroughly evaluate proposed Linux kernel changes. sashiko.dev.

💀 𝗖𝗧𝗙 𝗶𝘀 𝗱𝗲𝗮𝗱* A good rant on the impact of AI on CTF... k3ng.xyz/blog/ctf-is-....

k3ng.xyzk3ng.xyzCTF is dead*Capture-the-flag (CTF) competitions has been the biggest part of my journey in cyber security, and probably is the case for most people beginning their journey in cyber security. But I'm struggling to...

🛠️ 𝗛𝘆𝗼𝗸𝗲𝘁𝘀𝘂 – 𝗦𝗼𝗹𝘃𝗶𝗻𝗴 𝘁𝗵𝗲 𝗩𝗲𝗻𝗱𝗼𝗿 𝗗𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝗰𝘆 𝗣𝗿𝗼𝗯𝗹𝗲𝗺 𝗶𝗻 𝗥𝗘 Reversing Java and C# applications just became a lot easier thanks to the SearchLight Cyber team (ex: Assetnote): slcyber.io/research-cen....

slcyber.ioHyoketsu – Solving the Vendor Dependency Problem in RE › Searchlight CyberThe Long Decompilation Process Over the last eight or so years of performing security research at Assetnote, our research team has looked at countless enterprise applications that ship with hundreds, ...

PentesterLab reposted

Dominique Righetto

@righettod.eu

14 Mar

🧑‍🎓 Learning of the day for me thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation): #appsec #appsecurity

pentesterlab.comHow "Strengthening Crypto" Broke Authentication: FreshRSS and bcrypt's 72-Byte LimitAs part of our CVE monitoring, we came across GHSA-pcq9-mq6m-mvmp (CVE-2025-68402), an authentication bypass in FreshRSS, a self-hosted RSS aggregator. It ...

10 Mar

A commit meant to "strengthen the crypto" in FreshRSS ended up removing the need for a correct password. Why? Longer SHA-256 nonce + bcrypt truncation at 72 bytes. A nice example of why secure systems are about composition, not just stronger primitives. pentesterlab.com/blog/freshrs...

vibe-radar-ten.vercel.appVibe Security RadarTracking the security cost of vibe coding

8 Mar

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟬, 𝟮𝟬𝟮𝟲 A great mix of content this week! 🔒 𝗜𝗿𝗼𝗻𝗖𝘂𝗿𝘁𝗮𝗶𝗻: 𝗔 𝗣𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗔𝗜 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗕𝘂𝗶𝗹𝘁 𝗦𝗲𝗰𝘂𝗿𝗲 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗚𝗿𝗼𝘂𝗻𝗱 𝗨𝗽 Niels Provos (from OpenBSD's systrace) is sharing a new tool to sandbox your AI assistant: www.provos.org/p/ironcurtai....

😎 𝗩𝗶𝗯𝗲 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗥𝗮𝗱𝗮𝗿 A cool little project to track the security issues created by vibe coding: vibe-radar-ten.vercel.app.

codeant.aiCVE-2026-29000: Critical Auth Bypass in pac4j-jwt: Full PoC Using Only a Public KeyCodeAnt AI found a critical authentication bypass in pac4j-jwt where an attacker can impersonate any user using only the RSA public key. Full PoC and disclosure.

8 Mar

⛓️‍💥 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗕𝘆𝗽𝗮𝘀𝘀 𝗶𝗻 𝗽𝗮𝗰𝟰𝗷 Another issue with a library leveragining JWT: www.codeant.ai/security-res....

🚥 𝗺𝗶𝘁𝗺𝗽𝗿𝗼𝘅𝘆 𝗳𝗼𝗿 𝗳𝘂𝗻 𝗮𝗻𝗱 𝗽𝗿𝗼𝗳𝗶𝘁: 𝗜𝗻𝘁𝗲𝗿𝗰𝗲𝗽𝘁𝗶𝗼𝗻 𝗮𝗻𝗱 𝗔𝗻𝗮𝗹𝘆𝘀𝗶𝘀 𝗼𝗳 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗧𝗿𝗮𝗳𝗳𝗶𝗰 A write-up on how to use mitmproxy: www.synacktiv.com/en/publicati....

synacktiv.commitmproxy for fun and profit: Interception and Analysis of Applicationmitmproxy for fun and profit: Interception and Analysis of Application

blog.doyensec.com The MCP AuthN/Z Nightmare · Doyensec's Blog The MCP AuthN/Z Nightmare

8 Mar

✨ 𝗧𝗵𝗲 𝗠𝗖𝗣 𝗔𝘂𝘁𝗵𝗡/𝗭 𝗡𝗶𝗴𝗵𝘁𝗺𝗮𝗿𝗲 A reminder of the mess AuthN/Z with MCP is: blog.doyensec.com/2026/03/05/m....

wiki.notveg.ninjaBrowser-Based Port Scanning in the Age of LNA

1 Mar

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟵, 𝟮𝟬𝟮𝟲 Mostly AI... 💻 𝗕𝗿𝗼𝘄𝘀𝗲𝗿-𝗕𝗮𝘀𝗲𝗱 𝗣𝗼𝗿𝘁 𝗦𝗰𝗮𝗻𝗻𝗶𝗻𝗴 𝗶𝗻 𝘁𝗵𝗲 𝗔𝗴𝗲 𝗼𝗳 𝗟𝗡𝗔 Leveraging Local Network Access to create a port scanner! wiki.notveg.ninja/tools/lna-po....

substack.com100+ Kernel Bugs in 30 DaysHigh-Scale Driver Vulnerability Research with Agent Swarms

1 Mar

🪟 𝟭𝟬𝟬+ 𝗞𝗲𝗿𝗻𝗲𝗹 𝗕𝘂𝗴𝘀 𝗶𝗻 𝟯𝟬 𝗗𝗮𝘆𝘀 Behind the (impressive) result, the methodology is probably the most important. Make sure you read between the lines: substack.com/home/post/p-....

hacktron.aivinext: Vibe-Hacking Cloudflare's Vibe-Coded Next.js ReplacementCloudflare built a Next.js replacement in a week with AI for $1100. We pointed Hacktron at it to find what the tests missed.

1 Mar

⛈️ 𝘃𝗶𝗻𝗲𝘅𝘁: 𝗩𝗶𝗯𝗲-𝗛𝗮𝗰𝗸𝗶𝗻𝗴 𝗖𝗹𝗼𝘂𝗱𝗳𝗹𝗮𝗿𝗲'𝘀 𝗩𝗶𝗯𝗲-𝗖𝗼𝗱𝗲𝗱 𝗡𝗲𝘅𝘁.𝗷𝘀 𝗥𝗲𝗽𝗹𝗮𝗰𝗲𝗺𝗲𝗻𝘁 It's raining bugs in the cloud. A great example of agent capabilities on a never-seen-before target: www.hacktron.ai/blog/hacking....

pentesterlab.comPentesterLab: Learn with our JavaScript Code ReviewThe JavaScript Code Review Badge is our badge dedicated to security code review in JavaScript. It covers the discovery of weaknesses and vulnerabilities using source code review.

28 Feb

6 new code review labs just dropped 🚀 +3 for JavaScript Code Review +3 for Python Code Review JS: pentesterlab.com/badges/javas... Python: pentesterlab.com/badges/pytho...

ctftime.orgCTFtime.org / justCTF [*] 2020 / Go-fs / WriteupCTF writeups, Go-fs

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟴, 𝟮𝟬𝟮𝟲 Java x2, Go, JWT and a sprinkling of AI 🦫 𝗖𝗧𝗙𝘁𝗶𝗺𝗲.𝗼𝗿𝗴 / 𝗷𝘂𝘀𝘁𝗖𝗧𝗙 [*] 𝟮𝟬𝟮𝟬 / 𝗚𝗼-𝗳𝘀 / 𝗪𝗿𝗶𝘁𝗲𝘂𝗽 A cool Golang quirk via an unintended CTF solution ctftime.org/writeup/25852.

☕️ 𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟬𝟲𝟬𝟯: 𝗦𝗲𝗰𝗼𝗻𝗱-𝗢𝗿𝗱𝗲𝗿 𝗦𝗤𝗟 𝗜𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝗶𝗻 𝗛𝗶𝗯𝗲𝗿𝗻𝗮𝘁𝗲 𝗨𝗣𝗗𝗔𝗧𝗘/𝗗𝗘𝗟𝗘𝗧𝗘 (𝗜𝗻𝗹𝗶𝗻𝗲𝗜𝗱𝘀𝗢𝗿𝗖𝗹𝗮𝘂𝘀𝗲𝗕𝘂𝗶𝗹𝗱𝗲𝗿) A bit of a stretch but an interesting insight into Hibernate: www.herodevs.com/blog-posts/c....

herodevs.comHeroDevs Blog | CVE-2026-0603: Second-Order SQL Injection in Hibernate UPDATE/DELETE (InlineIdsOrClauseBuilder)CVE-2026-0603 is a high-severity second-order SQL injection vulnerability in Hibernate ORM caused by unsafe ID inlining during UPDATE and DELETE operations. Learn impact, root cause, and remediation.

blog.trailofbits.comUsing threat modeling and prompt injection to audit CometTrail of Bits used ML-centered threat modeling and adversarial testing to identify four prompt injection techniques that could exploit Perplexity’s Comet browser AI assistant to exfiltrate private Gma...

🤖 𝗨𝘀𝗶𝗻𝗴 𝘁𝗵𝗿𝗲𝗮𝘁 𝗺𝗼𝗱𝗲𝗹𝗶𝗻𝗴 𝗮𝗻𝗱 𝗽𝗿𝗼𝗺𝗽𝘁 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝘁𝗼 𝗮𝘂𝗱𝗶𝘁 𝗖𝗼𝗺𝗲𝘁 The team at Trail of Bits is sharing some key learnings from their audit of Comet (AI browser) blog.trailofbits.com/2026/02/20/u....

ctftime.orgCTFtime.org / justCTF [*] 2020 / Go-fs / WriteupCTF writeups, Go-fs

slcyber.ioAlmost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services › Searchlight CyberIntroduction We recently found ourselves looking into OpenText Directory Services (OTDS). We had seen it present on our customer's attack surface, and it seemed to be an interesting target. OTDS is a ...

☕️ 𝗔𝗹𝗺𝗼𝘀𝘁 𝗜𝗺𝗽𝗼𝘀𝘀𝗶𝗯𝗹𝗲: 𝗝𝗮𝘃𝗮 𝗗𝗲𝘀𝗲𝗿𝗶𝗮𝗹𝗶𝘇𝗮𝘁𝗶𝗼𝗻 𝗧𝗵𝗿𝗼𝘂𝗴𝗵 𝗕𝗿𝗼𝗸𝗲𝗻 𝗖𝗿𝘆𝗽𝘁𝗼 𝗶𝗻 𝗢𝗽𝗲𝗻𝗧𝗲𝘅𝘁 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 What an adventure in Java Deserialisation... slcyber.io/research-cen....

insinuator.netVulnerability Disclosure: JWT Authentication Bypass in OpenID Connect Authenticator for Tomcat – Insinuator.net

😱 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗗𝗶𝘀𝗰𝗹𝗼𝘀𝘂𝗿𝗲: 𝗝𝗪𝗧 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗕𝘆𝗽𝗮𝘀𝘀 𝗶𝗻 𝗢𝗽𝗲𝗻𝗜𝗗 𝗖𝗼𝗻𝗻𝗲𝗰𝘁 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗼𝗿 𝗳𝗼𝗿 𝗧𝗼𝗺𝗰𝗮𝘁 The exact same vulnerability I found in HarbourJWT but in a much cooler target, still not fixed... insinuator.net/2026/02/jwt-....

New lab: CVE-2026-24895 — FrankenPHP Path Confusion RCE (Unicode) People think "lowercase it" is harmless. In Unicode it’s not. Case folding can do weird mappings (Turkish i, Kelvin sign…), and sometimes worse: UTF-8 byte length changes. Hands-on lab: pentesterlab.com/exercises/cv...

hacktron.aiRCE in Google's AI code editor Antigravity - $10000 BountyHacktron AI Research Team discovered a critical RCE in Google’s Antigravity IDE that lets attackers take over your system just by opening a malicious website.

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟳, 𝟮𝟬𝟮𝟲 Parser Differential, TypeScript and AI 👇

🤖 𝗥𝗖𝗘 𝗶𝗻 𝗚𝗼𝗼𝗴𝗹𝗲'𝘀 𝗔𝗜 𝗰𝗼𝗱𝗲 𝗲𝗱𝗶𝘁𝗼𝗿 𝗔𝗻𝘁𝗶𝗴𝗿𝗮𝘃𝗶𝘁𝘆 - $𝟭𝟬𝟬𝟬𝟬 𝗕𝗼𝘂𝗻𝘁𝘆 A detailed blog post on hacking Antigravity with a lot of interesting details on its inner workings. www.hacktron.ai/blog/hacking....

sebsrt.xyzTrailing Danger: exploring HTTP Trailer parsing discrepanciesTrailing Danger: exploring HTTP Trailer parsing discrepancies

🚛 𝗧𝗿𝗮𝗶𝗹𝗶𝗻𝗴 𝗗𝗮𝗻𝗴𝗲𝗿: 𝗲𝘅𝗽𝗹𝗼𝗿𝗶𝗻𝗴 𝗛𝗧𝗧𝗣 𝗧𝗿𝗮𝗶𝗹𝗲𝗿 𝗽𝗮𝗿𝘀𝗶𝗻𝗴 𝗱𝗶𝘀𝗰𝗿𝗲𝗽𝗮𝗻𝗰𝗶𝗲𝘀 Probably one of the lesser-known features of HTTP... Trailers. This post provides details on the feature and explains how they can be leveraged to find security issues. www.sebsrt.xyz/blog/trailin....

praetorian.comIntroducing Augustus: Open Source LLM Prompt Injection ToolExplore LLM fingerprinting and its role in exposing vulnerable Ollama servers online to unauthorized access risks.

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟳, 𝟮𝟬𝟮𝟲 Parser Differential, TypeScript and AI 👇

⚒️ 𝗜𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝗶𝗻𝗴 𝗔𝘂𝗴𝘂𝘀𝘁𝘂𝘀: 𝗢𝗽𝗲𝗻 𝗦𝗼𝘂𝗿𝗰𝗲 𝗟𝗟𝗠 𝗣𝗿𝗼𝗺𝗽𝘁 𝗜𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝗧𝗼𝗼𝗹 Praetorian is back with another tool (one of their 12 Caesars): Augustus... Make sure you check it out! www.praetorian.com/blog/introdu....

blog.voorivex.teamblog.voorivex.team

🤺 𝗪𝗵𝗲𝗻 𝗧𝘄𝗼 𝗣𝗮𝗿𝘀𝗲𝗿𝘀 𝗗𝗶𝘀𝗮𝗴𝗿𝗲𝗲: 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗶𝗻𝗴 𝗤𝘂𝗲𝗿𝘆 𝗦𝘁𝗿𝗶𝗻𝗴 𝗗𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁𝗶𝗮𝗹𝘀 𝗳𝗼𝗿 𝗫𝗦𝗦 If you enjoy parser differential issues, you are going to love this exploit. Don't think "It's a CTF challenge" or "It's just an XSS", read between the lines to find the real gold. blog.voorivex.team/when-two-par....

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟳, 𝟮𝟬𝟮𝟲 Parser Differential, TypeScript and AI 👇

hetmehta.comBreaking Down CVE-2026-25049: How TypeScript Types Failed n8n's Security | hetmehta.comDeep technical analysis of CVE-2026-25049: How type confusion bypassed n8n's security patch and why TypeScript types aren't runtime security boundaries

⨐ 𝗕𝗿𝗲𝗮𝗸𝗶𝗻𝗴 𝗗𝗼𝘄𝗻 𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟮𝟱𝟬𝟰𝟵: 𝗛𝗼𝘄 𝗧𝘆𝗽𝗲𝗦𝗰𝗿𝗶𝗽𝘁 𝗧𝘆𝗽𝗲𝘀 𝗙𝗮𝗶𝗹𝗲𝗱 𝗻𝟴𝗻'𝘀 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 A great explanation of the recent vulnerabilities impacting n8n. If you are working in security on TypeScript projects, it's a must read. hetmehta.com/posts/n8n-ty....

github.comGitHub - semgrep/skills: A collection of skills for AI coding agents from SemgrepA collection of skills for AI coding agents from Semgrep - semgrep/skills

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟲, 𝟮𝟬𝟮𝟲 Busy week! AI, AI, AI and the death of Flash! 🤖 𝗦𝗲𝗺𝗴𝗿𝗲𝗽'𝘀 𝗔𝗴𝗲𝗻𝘁 𝗦𝗸𝗶𝗹𝗹𝘀 Semgrep released a set of agent skills worth looking into: github.com/semgrep/skills.

🦝 𝗗𝗶𝘀𝗰𝗼𝘃𝗲𝗿𝗶𝗻𝗴 𝗡𝗲𝗴𝗮𝘁𝗶𝘃𝗲-𝗗𝗮𝘆𝘀 𝘄𝗶𝘁𝗵 𝗟𝗟𝗠 𝗪𝗼𝗿𝗸𝗳𝗹𝗼𝘄𝘀 That's something I toyed with in 2012 (Monitoring repositories for Fun and Profit - Ruxcon 2012), I used basic rules at the time. Obviously, having LLMs is a game changer for this kind of workload: spaceraccoon.dev/discovering-....

spaceraccoon.devDiscovering Negative-Days with LLM WorkflowsIt’s no longer just about reverse-engineering n-days. You can detect vulnerabilities in open-source repositories before a CVE is published - or even if they’re never published. Here’s how I built an L...

medium.comWhat Really Killed Flash Player: A Six-Year Campaign of Deliberate Platform WorkThis is what it actually took. From the person who architected and drove Chrome’s Flash deprecation from proposal to the final removal in…

⚡️ 𝗪𝗵𝗮𝘁 𝗥𝗲𝗮𝗹𝗹𝘆 𝗞𝗶𝗹𝗹𝗲𝗱 𝗙𝗹𝗮𝘀𝗵 𝗣𝗹𝗮𝘆𝗲𝗿: 𝗔 𝗦𝗶𝘅-𝗬𝗲𝗮𝗿 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻 𝗼𝗳 𝗗𝗲𝗹𝗶𝗯𝗲𝗿𝗮𝘁𝗲 𝗣𝗹𝗮𝘁𝗳𝗼𝗿𝗺 𝗪𝗼𝗿𝗸 The story of the death of Adobe Flash, a must-read for AppSec practitioners. medium.com/@aglaforge/w....

github.comGitHub - semgrep/skills: A collection of skills for AI coding agents from SemgrepA collection of skills for AI coding agents from Semgrep - semgrep/skills

🚨 𝗔𝗻 𝗶𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻 𝘁𝗼 𝗮𝘂𝘁𝗼𝗺𝗮𝘁𝗲𝗱 𝗟𝗟𝗠 𝗿𝗲𝗱 𝘁𝗲𝗮𝗺𝗶𝗻𝗴 Promptfoo is a neat tool to add to your red teaming arsenal: blog.nviso.eu/2026/02/05/a....

blog.nviso.euBoost LLM Security: automated Red Teaming at Scale with PromptfooFind access-control flaws in LLM apps using Promptfoo plugins and strategies.

knifecoat.comScalable research tooling for agent systems - KnifeCoatIntro Hello neighbours! There is still little literature on designing offensive research systems and the tools that those systems use. Two likely explanations for this are that teams have internal to…

🛠️ 𝗦𝗰𝗮𝗹𝗮𝗯𝗹𝗲 𝗿𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝘁𝗼𝗼𝗹𝗶𝗻𝗴 𝗳𝗼𝗿 𝗮𝗴𝗲𝗻𝘁 𝘀𝘆𝘀𝘁𝗲𝗺𝘀 A great post on how to scale tooling for agent: knifecoat.com/Posts/Scalab....

github.comGitHub - semgrep/skills: A collection of skills for AI coding agents from SemgrepA collection of skills for AI coding agents from Semgrep - semgrep/skills

🤖 𝗘𝘃𝗮𝗹𝘂𝗮𝘁𝗶𝗻𝗴 𝗮𝗻𝗱 𝗺𝗶𝘁𝗶𝗴𝗮𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗴𝗿𝗼𝘄𝗶𝗻𝗴 𝗿𝗶𝘀𝗸 𝗼𝗳 𝗟𝗟𝗠-𝗱𝗶𝘀𝗰𝗼𝘃𝗲𝗿𝗲𝗱 𝟬-𝗱𝗮𝘆𝘀 This section resumes it: "Opus 4.6 is notably better at finding high-severity vulnerabilities than previous models": red.anthropic.com/2026/zero-da....

♦️ 𝗖𝗼 -𝗥𝗲𝗱𝗧𝗲𝗮𝗺: 𝗢𝗿𝗰𝗵𝗲𝘀𝘁𝗿𝗮𝘁𝗲𝗱 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗗𝗶𝘀𝗰𝗼𝘃𝗲𝗿𝘆 𝗮𝗻𝗱 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗮𝘁𝗶𝗼𝗻 𝘄𝗶𝘁𝗵 𝗟𝗟𝗠 𝗔𝗴𝗲𝗻𝘁𝘀 If you are working on a "LLM based hacker", you are going to want to read this: arxiv.org/pdf/2602.02164.

github.comGitHub - semgrep/skills: A collection of skills for AI coding agents from SemgrepA collection of skills for AI coding agents from Semgrep - semgrep/skills

blog.voorivex.teamblog.voorivex.team

🤿 𝗦𝗵𝗮𝗸𝗶𝗻𝗴 𝘁𝗵𝗲 𝗠𝗖𝗣 𝗧𝗿𝗲𝗲: 𝗔 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗗𝗲𝗲𝗽 𝗗𝗶𝘃𝗲 You may think "just another MCP bug" but this post is actually worth reading: blog.voorivex.team/shaking-the-....

PentesterLab reposted

Dominique Righetto

@righettod.eu

🧑‍🎓 Learning of the day for me thanks to @pentesterlab.com and Claude. 🔬 For the regular expression "[A-z]": In a character class [X-Y], it matches all characters with ASCII codes from X to Y inclusive. So [A-z] means all ASCII characters from 65 (A) to 122 (z). #appsec #appsecurity

6 Feb

MORE LABS IN OUR JAVASCRIPT CODE REVIEW BADGE: pentesterlab.com/badges/javas...

srcincite.ioSamstung Part 2 :: Remote Code Execution in MagicINFO 9 ServerIn part 1 I detailed my approach to following a rabbit hole that almost turned into pre-auth remote code execution with a default setup. Although I didn’t ac...

Research Worth Reading - Week 5, 2026 Bugs EVERYWHERE….

✨ Samstung Part 2 :: Remote Code Execution in MagicINFO 9 Server Steven Seeley is back with a new blog post and walks us through two bugs with source code to follow: srcincite.io/blog/2026/01...

pentesterlab.comCVE-2026-23993: JWT authentication bypass in HarbourJwt via “unknown alg”Deep dive into CVE-2026-23993: HarbourJwt accepts forged JWTs when alg is unknown, bypassing signature checks via empty signatures. Fix + code review lessons.

🪲 CVE-2026-23993: JWT authentication bypass in HarbourJwt via “unknown alg” I hope no one will mind that I put my own content in there. I^WClaude found a JWT bypass in HarbourJwt: pentesterlab.com/blog/cve-202...

synacktiv.comOn the clock: Escaping VMware Workstation at Pwn2Own Berlin 2025On the clock: Escaping VMware Workstation at Pwn2Own Berlin 2025

Research Worth Reading - Week 5, 2026 Bugs EVERYWHERE….

␛ On the clock: Escaping VMware Workstation at Pwn2Own Berlin 2025 Who doesn’t like a good Pwn2Own story, the sentence "Convinced that exploitation would be straightforward, we spent the second month procrastinating." especially hurts: www.synacktiv.com/en/publicati...

🪲 Insecure Defaults Detection Trail of Bits is sharing more and more skills. This one to detect: github.com/trailofbits/...

Research Worth Reading - Week 5, 2026 Bugs EVERYWHERE….

praetorian.comCorrupting the Hive Mind: Persistence Through Forgotten Windows InternalsSwarmer enables stealthy Windows registry persistence by exploiting mandatory user profiles and the Offline Registry API to bypass EDR detection. Learn how this technique leverages NTUSER.MAN files to...

🪟 Corrupting the Hive Mind: Persistence Through Forgotten Windows Internals The team from Praetorian is sharing a new tool that will surely be added to your Windows Red Team arsenal: www.praetorian.com/blog/corrupt...