Everyone is panicking about AI-generated zero days like it's an attacker story. It's not. Defenders can use the best models against their own code right now. Your progress compounds. Attackers' job gets harder. pentesterlab.com/blog/defende...

Defenders Finally Have the Edge - PentesterLab's Blog

AI agents are changing vulnerability research, but the real advantage goes to defenders. Attackers face air-gap constraints while defenders get full access to frontier models on their own code. Every ...

pentesterlab.com

DO NOT JAVASCRIPT TODAY. I REPEAT: DO NOT, UNDER ANY CIRCUMSTANCES, JAVASCRIPT TODAY.

I spent last week, this week-end and the start of this week working on a redesign of @pentesterlab.com 's website. Aiming for something a bit more modern... Let me know what you think!

Our schedule is up, and we're excited to announce our speaker @snyff.pentesterlab.com is joining us on stage with I DON'T LIKE THIS CODE!!! Get ready to walk through a series of real-world inspired code snippets with one minute to figure it out. Only question, will there be jeopardy music?

Closing keynote for Day 1 announced for BSides Prague 2026 🎉 Louis Nyffenegger (@snyff.pentesterlab.com), application security expert and founder of PentesterLabs, is joining us! 📷 April 23, 2026 Don’t miss it. 📷🔥 #bsides #bsidesprg #keynote

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟵, 𝟮𝟬𝟮𝟲 Mostly AI... 💻 𝗕𝗿𝗼𝘄𝘀𝗲𝗿-𝗕𝗮𝘀𝗲𝗱 𝗣𝗼𝗿𝘁 𝗦𝗰𝗮𝗻𝗻𝗶𝗻𝗴 𝗶𝗻 𝘁𝗵𝗲 𝗔𝗴𝗲 𝗼𝗳 𝗟𝗡𝗔 Leveraging Local Network Access to create a port scanner! wiki.notveg.ninja/tools/lna-po....

I wrote about what happens when you rewrite mature software with agents. You rebuild the features. You don't rebuild the scars. vinext: one engineer, one week, $1,100 in tokens. Then plenty of vulnerabilities found within days. pentesterlab.com/blog/what-yo...

What you don't see - PentesterLab's Blog

More and more, with the progress of coding agents, people are rewriting software.And honestly, it looks easy. You write a good ...

pentesterlab.com

SEE MUM, "I" CAN STILL FIND BUGS!

PentesterLab@pentesterlab.com · 7mo ago

🔥 CVE-2026-23993: HarbourJwt JWT auth bypass via unknown alg. Not just alg=none: unsupported alg => empty signature, so forged token header.payload. passes. Write-up + fix: pentesterlab.com/blog/cve-202...

Today (2025-12-29) is 2026-W01-1 in ISO week-date 🤯\ So it’s the first day of ISO week-year 2026, even though the date is still 2025. (Week 1 = week with the first Thursday)

Black Friday at @pentesterlab.com 🧨 For a limited time: 🔒 1 year of PRO for $146.52 🎓 Student special: 3 months PRO for $25.99 Hands-on labs. Real CVEs. Security code review training used by real AppSec & pentest teams. ⏰ Offer ends 2 Dec 2025, 23:59:59 UTC 👉 pentesterlab.com/pro

I have been using docker for 10 years... Today I learned that you don't need to provide the full container id when you run docker exec...

Really awesome preso from @snyff.pentesterlab.com @pentesterlab.com over at BSides Perth. Jam packed with patterns, approaches, tips and tricks to level up finding bugs in code. #bsides #bsidesperth

I’ve spent 2 solid hours doing bug bounty and I still haven’t made $200k. Can someone tell me what I’m doing wrong? #bugbountytips

AI-generated code is reshaping secure code review—fewer trivial bugs, but more hidden threats. Read more in our new blog post: pentesterlab.com/blog/secure-... What do you think?

How AI-Generated Code Is Changing Secure Code Review

Learn how AI-generated code impacts secure code review and application security. Discover why AI excels at catching common vulnerabilities but needs human expertise for complex bugs.

pentesterlab.com

Think teaching devs to hack is risky? In reality, a bit of hacking knowledge helps them spot vulnerabilities early and build stronger apps. Discover why having devs with a 'hacker mindset' is a win for security: pentesterlab.com/blog/why-dev...

I Don’t Want My Devs to Become Hackers! - PentesterLab's Blog

Discover why encouraging developers to learn ethical hacking boosts security, reduces bugs, and fosters a proactive security culture in your organization.

pentesterlab.com

From now on, I'll call any snippet of vulnerable code shared on Social Media as "Security Code Review Porn" It gives the wrong expectations about what real code review actually involves.

Articles worth reading discovered last week: 🤝 blog.doyensec.com/2025/01/30/o... ☠️ www.feistyduck.com/newsletter/i... 📚 pathonproject.com/zb/?871f0933... And as always, it’s in our blog: pentesterlab.com/blog/researc... #PentesterLabWeekly

I’m excited to share that in a few weeks I’ll be heading to the US for a series of talks and workshops focused on security code review and JWT—and I’ll be bringing some @pentesterlab.com swag along too!

🚀 Level up your #CyberSecurity skills FOR FREE! 🛡️ Earn the Recon Badge with Pentesterlab and master: 🔍 Virtual Hosts 🌐 DNS Recon 🔒 TLS Recon ...and so much more! Start your journey today 👉 pentesterlab.com/badges/recon

PentesterLab: Learn with our Recon Badge

The Recon badge is our set of exercises created to help you learn Reconnaissance. From findings usual files down to DNS and TLS exploration, this badge will help you get better at finding new targets

pentesterlab.com

...

Networking in InfoSec isn’t just about IP addresses and ports—it’s also about people! Discover how meetups, conferences, and volunteering can open big career doors in InfoSec. Read more: pentesterlab.com/blog/infosec...

Networking but not TCP/IP - PentesterLab's Blog

Discover how building real-world connections in the InfoSec community can accelerate your journey into pentesting and cybersecurity. From local meetups and conferences to online communities, this guid...

pentesterlab.com

Someone shared this write-up in the @pentesterlab.com 's discord: www.wiz.io/blog/nuclei-... I love this article so much! The content and the analysis are A+ I really like the 🚩 (very similar to pentesterlab.com/blog/another...)

A Signature Verification Bypass in Nuclei (CVE-2024-43405) | Wiz Blog

Wiz's engineering team discovered a high-severity signature verification bypass in Nuclei which could potentially lead to arbitrary code execution.

wiz.io

Have a great weekend and enjoy some tunes: youtu.be/j_Md8_7mhOU

joernchen - Friday 13th @ 1°C

YouTube video by Tiny Club Berlin

youtu.be

If your New Year’s resolution is to get better at web security code review, don’t miss our upcoming live training. Learn how to find vulnerabilities and strengthen your skills: pentesterlab.gumroad.com

Subscribe to PentesterLab on Gumroad

PentesterLab is an easy and great way to learn security code review and penetration testing. We provide vulnerable systems that can be used to test and understand vulnerabilities.

pentesterlab.gumroad.com

Happy New Year! pentesterlab.com/gift/xDzcB35... (3-month) pentesterlab.com/gift/UBMtCsi... (3-month) pentesterlab.com/gift/BWEYEme... (3-month)

Learn Web Penetration Testing: The Right Way

Learn Web Penetration Testing: The Right Way

pentesterlab.com

Golang: because hackers haven’t given up on SQL injection in 2024...

🎅 pentesterlab.com/gift/v5kegJq... (3-month) pentesterlab.com/gift/4VG6RYU... (3-month) pentesterlab.com/gift/lsgfEwJ... (3-month)

Learn Web Penetration Testing: The Right Way

Learn Web Penetration Testing: The Right Way

pentesterlab.com

I put together a VERY limited (for now) list of web hackers in a Starter pack: go.bsky.app/9uay4Ad A lot of people are missing (I will try to add more as I find them) but make sure you follow people already in the list!

Cross-Site POST Requests Without a Content-Type Header by @lukejahnke https://nastystereo.com/security/cross-site-post-without-content-type.html #BBRENewsletter85