🧑‍🎓 Learning of the day for me, once again thanks to @pentesterlab.com (for the presentation of the behavior and the lab) and Claude (for more detailed explanation). #appsec #appsecurity

🏖️🐻 Les logiciels libres de l'été, jour 35 Typer : une bibliothèque Open Source pour créer des applications en CLI que les utilisateurs adoreront utiliser et que les développeurs prendront plaisir à concevoir. Elle repose sur les hints de type de Python.

The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised. blog.pypi.org/posts/2026-0... #python #security #supplychain #pypi

Releases now reject new files after 14 days - The Python Package Index Blog

PyPI no longer allows publishing new files to releases older than 14 days.

blog.pypi.org

blog.elcomsoft.com/2026/07/an-a... an interesting point of view on the OpenAI/Hugging Face incident

An AI agent broke into Hugging Face. Five days later, OpenAI said it was theirs

On 16 July 2026, Hugging Face disclosed that an autonomous AI agent had been inside part of its production infrastructure. The company was clear about what it d

blog.elcomsoft.com

📡 OWASP Secure Headers Project - update: 1) We added info about the header "Integrity-Policy". 2) We defined the rules about GenIA usage. 3) We also developed a AI agent to help us (beta). 📖 github.com/OWASP/www-pr... 🤖 github.com/righettod/os... #appsec #appsecurity #owasp_shp

Voxxed Days Luxembourg 2026 talks are now online for you to enjoy 😀 ! luxembourg.voxxeddays.com/en/#videos ---- Les présentations de Voxxed Days Luxembourg 2026 sont maintenant en ligne et prêtes à déguster! 😀 luxembourg.voxxeddays.com/en/#videos

📡 OWASP Secure Headers Project: We have completed the migration on our end, even though the foundation has postponed the release of the CMS. #appsec #appsecurity #owasp_shp 📖 github.com/OWASP/www-pr...

GitHub - OWASP/www-project-secure-headers: The OWASP Secure Headers Project

The OWASP Secure Headers Project. Contribute to OWASP/www-project-secure-headers development by creating an account on GitHub.

github.com

📡 OWASP Secure Headers Project: We have been informed that the foundation will launch its new website on June 24; therefore, we have begun the migration process today. We apologize for any broken links that may occur over the next few days or weeks. #appsec #appsecurity #owasp_shp

Assessments of threats can be seen from different perspectives. Developers may come across privacy impact assessments (PIAs), where threats to users' data and the impact on those users are paramount. PIAs may additionally examine harms to organisations, third parties and wider society. (1/6) #games

Next week, at VOXXED Days Luxembourg @lu.voxxeddays.com , I will present a version of the "Die & Retry" concept applied to the file upload feature, specifically for cases where PDF files are accepted 😉 m.devoxx.com/events/voxxe... #appsec #voxxed_lu

📡 OWASP Secure Headers Project - We have made the following updates: 1) Section "Code Snippets": The user prompt has been updated to allow direct generation of a web/application server configuration using the online JSON reference file. #appsec #appsecurity #owasp_shp

I needed code snippets for presentations. I was worried about pasting code snippets into untrusted sites. So I just wrote my own using AI. You can trust I won't be tracking your code. It's very customisable and the default is for presentations. hackvertor.co.uk/snippet

🧑‍🎓 As part of my homework on AI from an application security perspective, I decided to investigate how AI, through a coding assistant (Claude Code in my case), can be used in the following areas: #appsec #appsecurity #ai

New badge: JavaScript Sandbox Escape! The first 4 labs are live. If you ship anything that evaluates untrusted or model-generated JavaScript, this badge is for you: pentesterlab.com/badges/javas...

PentesterLab: Learn with our JavaScript Sandbox Escaping

This badge covers JavaScript sandbox escape vulnerabilities. From prototype chain navigation and Function constructor abuse to vm module escapes, static-eval bypasses, real-world CVEs, and advanced pr...

pentesterlab.com

We've launched a new free Web Security Academy topic on exploiting AI-powered security scanners! Learn how to use indirect prompt injection to steal data, cause damage & trigger exploit chains! Dive in here: portswigger.net/web-security...

AI-powered scanner vulnerabilities | Web Security Academy

Application security teams often deploy AI-powered scanners that use Large Language Models (LLMs) to scan web applications for vulnerabilities. While ...

portswigger.net

With the new version of git, Welcome to the new "git history" command! 🎉 Rewording and split commits will be finally easier than before. 💪 github.blog/open-source/...

📡 OWASP Secure Headers Project: We have refactored the section on the browser’s "Local Network Access" feature. #appsec #appsecurity #owasp_shp 📖 owasp.org/www-project-...

In collaboration with a couple of other leaders in the industry we are releasing securitytitles.com - It's an attempt to provide transparency about role levels, expectations and (just for the US market currently, salary ranges). For leaders writing JDs and candidates alike.

🎉 After a few years of refinement and close to 1 >> 9 commits, I'm pleased to announce the v1 release of my CORS middleware library for Go. Let me know whether it patches things up between you and CORS! github.com/jub0bs/cors #golang #CORS

GitHub - jub0bs/cors: perhaps the best CORS middleware library for Go

perhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

github.com

Everyone is panicking about AI-generated zero days like it's an attacker story. It's not. Defenders can use the best models against their own code right now. Your progress compounds. Attackers' job gets harder. pentesterlab.com/blog/defende...

Defenders Finally Have the Edge - PentesterLab's Blog

AI agents are changing vulnerability research, but the real advantage goes to defenders. Attackers face air-gap constraints while defenders get full access to frontier models on their own code. Every ...

pentesterlab.com

The Cornucopia of Gamified Threat Modeling At the OWASP Cornucopia project, we are done with updating the cards and help pages for the Website App Edition v3.0! dev.to/owasp/the-co... #appsec #cybersecurity #gamedev #security

The Cornucopia of Gamified Threat Modeling

At the OWASP Cornucopia project, we are done with updating the cards and help pages for the Website...

dev.to

heads up: FreeBSD forums hacked. Be caeeful with your email or DMs coming from FreeBSD forum or freebsd{.}org for some time now. https:// forums {.} freebsd {.} org/

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟯, 𝟮𝟬𝟮𝟲 Only one entry but definitely worth reading! ☁️ 𝗥𝗲𝗺𝗼𝘁𝗲 𝗖𝗼𝗺𝗺𝗮𝗻𝗱 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 𝗶𝗻 𝗚𝗼𝗼𝗴𝗹𝗲 𝗖𝗹𝗼𝘂𝗱 𝘄𝗶𝘁𝗵 𝗦𝗶𝗻𝗴𝗹𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗗𝗲𝗹𝗲𝘁𝗶𝗼𝗻 This one is a real tour de force: flatt.tech/research/pos....

Remote Command Execution in Google Cloud with Single Directory Deletion

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google. During...

flatt.tech

Dear contributors to Voxxed Days Luxembourg's renewed success: the call for your papers, supposedly closed tonight wil be extended by 2 weeks to accomodate latecomers. A small reminder: 15 min. lunch talks are often under-filled, to test your speaker abilities, this is a perfect opportunity!

🧑‍🎓 Learning of the day for me, once again thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation). #appsec #appsecurity

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟮, 𝟮𝟬𝟮𝟲 AI doing research, AI killing CTF 🤖 𝗧𝗲𝘀𝘁𝗶𝗻𝗴 𝗔𝗜 𝗳𝗼𝗿 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝟰 𝗔𝗽𝗽𝗿𝗼𝗮𝗰𝗵𝗲𝘀 & 𝗪𝗵𝗲𝗿𝗲 𝗜 𝗙𝗮𝗶𝗹𝗲𝗱 If you can only read one thing this week, make it this article: xclow3n.github.io/post/7.

Le CFP des 10 ans de VoxxedDays Luxembourg est toujours ouvert, ne trainez plus :) → voxxedlu2026.cfp.dev#/

🧑‍🎓 Learning of the day for me thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation): #appsec #appsecurity

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟬, 𝟮𝟬𝟮𝟲 A great mix of content this week! 🔒 𝗜𝗿𝗼𝗻𝗖𝘂𝗿𝘁𝗮𝗶𝗻: 𝗔 𝗣𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗔𝗜 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗕𝘂𝗶𝗹𝘁 𝗦𝗲𝗰𝘂𝗿𝗲 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗚𝗿𝗼𝘂𝗻𝗱 𝗨𝗽 Niels Provos (from OpenBSD's systrace) is sharing a new tool to sandbox your AI assistant: www.provos.org/p/ironcurtai....