New badge: JavaScript Sandbox Escape! The first 4 labs are live. If you ship anything that evaluates untrusted or model-generated JavaScript, this badge is for you: pentesterlab.com/badges/javas...

PentesterLab: Learn with our JavaScript Sandbox Escaping

This badge covers JavaScript sandbox escape vulnerabilities. From prototype chain navigation and Function constructor abuse to vm module escapes, static-eval bypasses, real-world CVEs, and advanced pr...

pentesterlab.com

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟯, 𝟮𝟬𝟮𝟲 Only one entry but definitely worth reading! ☁️ 𝗥𝗲𝗺𝗼𝘁𝗲 𝗖𝗼𝗺𝗺𝗮𝗻𝗱 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 𝗶𝗻 𝗚𝗼𝗼𝗴𝗹𝗲 𝗖𝗹𝗼𝘂𝗱 𝘄𝗶𝘁𝗵 𝗦𝗶𝗻𝗴𝗹𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗗𝗲𝗹𝗲𝘁𝗶𝗼𝗻 This one is a real tour de force: flatt.tech/research/pos....

Remote Command Execution in Google Cloud with Single Directory Deletion

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google. During...

flatt.tech

🧑‍🎓 Learning of the day for me, once again thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation). #appsec #appsecurity

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟮, 𝟮𝟬𝟮𝟲 AI doing research, AI killing CTF 🤖 𝗧𝗲𝘀𝘁𝗶𝗻𝗴 𝗔𝗜 𝗳𝗼𝗿 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝟰 𝗔𝗽𝗽𝗿𝗼𝗮𝗰𝗵𝗲𝘀 & 𝗪𝗵𝗲𝗿𝗲 𝗜 𝗙𝗮𝗶𝗹𝗲𝗱 If you can only read one thing this week, make it this article: xclow3n.github.io/post/7.

🧑‍🎓 Learning of the day for me thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation): #appsec #appsecurity

A commit meant to "strengthen the crypto" in FreshRSS ended up removing the need for a correct password. Why? Longer SHA-256 nonce + bcrypt truncation at 72 bytes. A nice example of why secure systems are about composition, not just stronger primitives. pentesterlab.com/blog/freshrs...

How "Strengthening Crypto" Broke Authentication: FreshRSS and bcrypt's 72-Byte Limit

As part of our CVE monitoring, we came across GHSA-pcq9-mq6m-mvmp (CVE-2025-68402), an authentication bypass in FreshRSS, a self-hosted RSS aggregator. It ...

pentesterlab.com

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟬, 𝟮𝟬𝟮𝟲 A great mix of content this week! 🔒 𝗜𝗿𝗼𝗻𝗖𝘂𝗿𝘁𝗮𝗶𝗻: 𝗔 𝗣𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗔𝗜 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗕𝘂𝗶𝗹𝘁 𝗦𝗲𝗰𝘂𝗿𝗲 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗚𝗿𝗼𝘂𝗻𝗱 𝗨𝗽 Niels Provos (from OpenBSD's systrace) is sharing a new tool to sandbox your AI assistant: www.provos.org/p/ironcurtai....

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟵, 𝟮𝟬𝟮𝟲 Mostly AI... 💻 𝗕𝗿𝗼𝘄𝘀𝗲𝗿-𝗕𝗮𝘀𝗲𝗱 𝗣𝗼𝗿𝘁 𝗦𝗰𝗮𝗻𝗻𝗶𝗻𝗴 𝗶𝗻 𝘁𝗵𝗲 𝗔𝗴𝗲 𝗼𝗳 𝗟𝗡𝗔 Leveraging Local Network Access to create a port scanner! wiki.notveg.ninja/tools/lna-po....

6 new code review labs just dropped 🚀 +3 for JavaScript Code Review +3 for Python Code Review JS: pentesterlab.com/badges/javas... Python: pentesterlab.com/badges/pytho...

PentesterLab: Learn with our JavaScript Code Review

The JavaScript Code Review Badge is our badge dedicated to security code review in JavaScript. It covers the discovery of weaknesses and vulnerabilities using source code review.

pentesterlab.com

As I mentioned last week I ordered some books (which got delivered this week) CVE ARCHEOLOGIST'S FIELD GUIDE by Louis Nyffenegger @pentesterlab.com

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟴, 𝟮𝟬𝟮𝟲 Java x2, Go, JWT and a sprinkling of AI 🦫 𝗖𝗧𝗙𝘁𝗶𝗺𝗲.𝗼𝗿𝗴 / 𝗷𝘂𝘀𝘁𝗖𝗧𝗙 [*] 𝟮𝟬𝟮𝟬 / 𝗚𝗼-𝗳𝘀 / 𝗪𝗿𝗶𝘁𝗲𝘂𝗽 A cool Golang quirk via an unintended CTF solution ctftime.org/writeup/25852.

New lab: CVE-2026-24895 — FrankenPHP Path Confusion RCE (Unicode) People think "lowercase it" is harmless. In Unicode it’s not. Case folding can do weird mappings (Turkish i, Kelvin sign…), and sometimes worse: UTF-8 byte length changes. Hands-on lab: pentesterlab.com/exercises/cv...

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟳, 𝟮𝟬𝟮𝟲 Parser Differential, TypeScript and AI 👇

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟲, 𝟮𝟬𝟮𝟲 Busy week! AI, AI, AI and the death of Flash! 🤖 𝗦𝗲𝗺𝗴𝗿𝗲𝗽'𝘀 𝗔𝗴𝗲𝗻𝘁 𝗦𝗸𝗶𝗹𝗹𝘀 Semgrep released a set of agent skills worth looking into: github.com/semgrep/skills.

GitHub - semgrep/skills: A collection of skills for AI coding agents from Semgrep

A collection of skills for AI coding agents from Semgrep - semgrep/skills

github.com

🧑‍🎓 Learning of the day for me thanks to @pentesterlab.com and Claude. 🔬 For the regular expression "[A-z]": In a character class [X-Y], it matches all characters with ASCII codes from X to Y inclusive. So [A-z] means all ASCII characters from 65 (A) to 122 (z). #appsec #appsecurity

MORE LABS IN OUR JAVASCRIPT CODE REVIEW BADGE: pentesterlab.com/badges/javas...

Research Worth Reading - Week 5, 2026 Bugs EVERYWHERE….

🔥 CVE-2026-23993: HarbourJwt JWT auth bypass via unknown alg. Not just alg=none: unsupported alg => empty signature, so forged token header.payload. passes. Write-up + fix: pentesterlab.com/blog/cve-202...

CVE-2026-23993: JWT authentication bypass in HarbourJwt via “unknown alg”

I didn't know Harbour even existed as a language when I found this bug. The fun part is that I also ...

pentesterlab.com

Research Worth Reading Week 03/2026 Claude RedTeam, Claude Hacking, Claude Skills...Is it Claude week? 🤖 AI models are showing a greater ability to find and exploit vulnerabilities The latest Claude models are getting noticeably better at hacking: red.anthropic.com/2026/cyber-t...

Happy New Year! Research Worth Reading Week 01/2026! 💧 Cross-Site ETag Length Leak An amazing CTF write-up on XS Leaks. Make sure you also read the unintended solution linked at the bottom of the page: blog.arkark.dev/2025/12/26/e...

Cross-Site ETag Length Leak | XS-Spin Blog

A novel XS-Leak technique that turns ETag length differences into a cross-site oracle via 431 errors and History API.

blog.arkark.dev

A surprise from @pentesterlab.com

Research Worth Reading Week 51/2025 A quieter week that perfectly fits the two deep dives! 📚 ORM Leaking More Than You Joined For The latest opus in Elttam's posts on ORM leaks, including some semgrep rules and a reference to my blog post on the subject: www.elttam.com/blog/leaking...

Research Worth Reading Week 50/2025: SAML bypasses & LLM-assisted crash triage. 🔒 The Fragile Lock: Novel Bypasses for SAML Authentication Ruby SAML falls again. An extraordinary exploit by the PortSwigger team: portswigger.net/research/the...

The Fragile Lock: Novel Bypasses For SAML Authentication

TLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi

portswigger.net

🧑‍🎓 Learning of the day for me thanks to: - @pentesterlab.com for the presentation of the behavior and the code review lab. - ChatGPT for the detailed explanation. #appsec #appsecurity #python

I just completed @pentesterlab.com 's Recon Badge!!!

Welcome back to Slytherin! 🐍 We just released 3 new labs in our python^w Slytherin code review badge: real CVEs, sneaky bugs, and plenty of chances to sharpen your dark code arts.. Grab your wand here: pentesterlab.com/badges/pytho...

PentesterLab: Learn with our Python Code Review Badge

The Python Code Review Badge is our badge dedicated to code review in Python. It covers the discovery of weaknesses and vulnerabilities using source code review.

pentesterlab.com

Research Worth Reading Week 49/2025: ⏰ Introducing constant-time support for LLVM to protect cryptographic code Trail of Bits explains their work on adding constant-time support to LLVM so that compiled cryptographic code remains constant-time: blog.trailofbits.com/2025/12/02/i...

Introducing constant-time support for LLVM to protect cryptographic code

Trail of Bits developed constant-time coding support for LLVM that prevents compilers from breaking cryptographic implementations vulnerable to timing attacks, introducing the __builtin_ct_select fami...

blog.trailofbits.com

Black Friday at @pentesterlab.com 🧨 For a limited time: 🔒 1 year of PRO for $146.52 🎓 Student special: 3 months PRO for $25.99 Hands-on labs. Real CVEs. Security code review training used by real AppSec & pentest teams. ⏰ Offer ends 2 Dec 2025, 23:59:59 UTC 👉 pentesterlab.com/pro

Added 3 new Java CVEs to our Java Code Review Badge! Now at 64 real-world labs to sharpen your Java code review skills. Try them here: pentesterlab.com/badges/java-... More CVEs coming soon 👀🔥

PentesterLab: Learn with our Java Code Review Badge

The Java Code Review Badge is our badge dedicated to code review in Java. It covers the discovery of weaknesses and vulnerabilities using source code review.

pentesterlab.com

Articles worth reading discovered last week: 📲 security.googleblog.com/2025/11/rust... 📸 www.pixnapping.com 🧩 www.praetorian.com/blog/how-i-f... 🤖 buganizer.cc/hacking-gemi...

Rust in Android: move fast and fix things

Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in ...

security.googleblog.com