The Sanitizer API landed in Firefox 148, along with element.setHTML(). This lets you fully configure how HTML strings are cleaned as they're parsed. hacks.mozilla.org/2026/02/good...

Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 – Mozilla Hacks - the Web developer blog

Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted…

hacks.mozilla.org

Been relatively quiet few months, I started a new job which has taken all my time . Looking forward to catching up on the new posts here

Free JavaScript security course from @openjsf.org / @linuxfoundation.org training.linuxfoundation.org/training/int...

Introduction to JavaScript Security (LFS184) | Linux Foundation Education

Master secure coding with our free course, Introduction to JavaScript Security (LFS184)—essential for today’s web developers.

training.linuxfoundation.org

Nano Banana opinion on this is

I've been SHA-1 pinning ever since I started using GitHub Actions, but I didn't think of transitive (compound) actions, which can use unpinned sub-actions. This is fine 🔥🐶☕🔥 Time to setup zizmor.sh by @yossarian.net for automated scanning, I've had it in my "tools to try" list for a bit.

anthonyhanel.me/posts/Fixing... How to fix Ubuntu24 burpdefault browser issue

How to Securely Fix Burp Suite’s Default Browser on Ubuntu 24.04

Burp Suite’s built-in browser not launching on Ubuntu 24.04? This post will go over a more secure way to fix it with AppArmor, while avoiding dangerous SUID “fixes” that don’t follow the Principle of ...

anthonyhanel.me

I tested the POC and it works reliably, please patch fast !

Datadog Security Labs@securitylabs.datadoghq.com · 10mo ago

Update: A PoC was made available on GitHub by a security engineer. Our post was updated to reflect this new information, along with an illustration of how the exploit works.

I wrote a blog post about how I use Claude Code (and other models) in my work: invicti.com/blog/securit...

Security Research in the Age of AI Tools

Learn how AI tools can support security researchers in investigating vulnerabilities and designing security checks to detect them.

invicti.com

If you want to just reverse the order use tac /etc/passwd Yes "tac" is an inbuilt command :D reverse of cat @agarri.fr

Nicolas Grégoire@agarri.fr · 10mo ago

A little command-line trick... 🛠️ 🤓 You can use `rev` twice in order to process something from right to left. For example, in order to sort /etc/passwd by shell: cat /etc/passwd | rev | sort | rev

Finally got around to reading all the MCP security blog posts by @lirantal.com highly recommend it, if you are working on MCP related stuff www.nodejs-security.com/tag/mcp/

Posts by tag 'mcp'

nodejs-security.com

this is a really well written article on why Cross-site Scripting (XSS) vulnerabilities still exist today flatt.tech/research/pos...

Good read

Phil Eaton@eatonphil.bsky.social · 10mo ago

Turns out you can communicate across containers via 63-bits of available space in a shared lock you acquire on /proc/self/ns/time that all processes have access to. No networking required. The post has a demo of a chat app communicating across unprivileged containers. h4x0r.org/funreliable/

Excited to announce that I started a new $job. Haven't had much time recently to read on all new research and blogs. Hoping to be back on track by December :)

I generated 20k vibe-coded web applications using various models via the OpenRouter API and analyzed them for security issues. The apps are available for download if anyone wants to take a look. www.invicti.com/blog/securit...

Security Issues in Vibe-Coded Web Apps: Analysis, Vulnerabilities, Scanning

Learn about common security issues in AI-generated software, based on an analysis of over 20,000 vibe-coded web apps.

invicti.com

The release candidate of the OWASP Top 10 2025 has been released owasp.org/Top10/2025/0... The definitive release should be out on November 20th

is anyone using Deno and the secure-by-default permissions system and this saved them please raise your hand I want to chat and learn more I appreciate Deno and Node.js (less comprehensive) for this but I'm unconvinced this helps against supply chain security attacks

astral.sh/blog/python-...

Python 3.14

Python 3.14 is out today along with updates for Ruff and uv.

astral.sh

🐍 New on the blog: PEP 810 adds 'lazy import' syntax to defer module loading until first use, cutting startup time by 50–70%. Already sparking debate: an HN thread hit 350+ points and ~200 comments in <24 hrs. #Python Read More → socket.dev/blog/pep-810-proposes-explicit-lazy-imports-for-python-3-15

PEP 810 Proposes Explicit Lazy Imports for Python 3.15 - Soc...

An opt-in lazy import keyword aims to speed up Python startups, especially CLIs, without the ecosystem-wide risks that sank PEP 690.

socket.dev

I have also moved to full devcontainer flow for local dev. I should try this with local password manager like Keepass.

Liran Tal@lirantal.com · 11mo ago

New write-up on how to remove the risk of supply chain attacks for developers: 1Password + DevContainers and I have a recipe here for it:

The npx -p with a which flag is so incredibly useful if you manage multiple Node.js versions and I only recently discovered that I actually need it, more npm commands too here:

If you deal with terminal apps, you need to use github.com/alexellis/ar... by @alexellis.bsky.social

GitHub - alexellis/arkade: Open Source Marketplace For Developer Tools

Open Source Marketplace For Developer Tools. Contribute to alexellis/arkade development by creating an account on GitHub.

github.com

Using vibe coding to change a front end from pyqt to React. Harder than I expected but fun.

Nice !!! @feross.bsky.social

Feross@feross.bsky.social · 12mo ago

🚨 Open source supply chain attacks are exploding. Starting today, that ends. We’re releasing Socket Firewall — FREE, zero-config, CLI that blocks malware before it lands on your laptop or CI. Just run: npm i -g sfw sfw npm install lodash Works for: npm, yarn, pnpm, pip, uv, and cargo.

If you want to test AWS locally @localstack.cloud is the way to go . Simulate all services with one docker container

Looking at supply chain security. This is a good diagram explaining how the whole thing is put together

Yet again another nice writeup. TIL even if there is no stored procedure, we can call inbuilt pg functions via SQLI Bit obvious after reading " but you only know, what you dont know after knowing what you know "

Liran Tal@lirantal.com · 12mo ago

new MCP Server vulnerability I reported now publicly disclosed... try to avoid these insecure code conventions please: github.com/executeautom...

www.aikido.dev/blog/bugs-in...

Bugs in Shai-Hulud: Debugging the Desert

The Shai Hulud worm had some bugs of its own, and required patching by the attackers. We also look at a timeline of events, to see how it unfolded.

aikido.dev

t.co/ahXcEISmbd This is a fantastic blog post by @charlieeriksen.bsky.social

t.co/ahXcEISmbd This is a fantastic blog post by @charlieeriksen.bsky.social

mathspp.com/blog/uv-chea... Good cheat sheet to keep in hand cc @mathsapp.bsky.social

uv cheatsheet

Cheatsheet with the most common and useful uv commands to manage projects and dependencies, publish projects, manage tools, and more.

mathspp.com

POV: Solo Security engineer one hour into the NPM supply chain crisis meeting with various PM . But the whole code base is in Java and C.

a man with a ring on his finger is smiling with his hand on his chin

ALT: a man with a ring on his finger is smiling with his hand on his chin

media.tenor.com