Next week I'll present "Can AI Do Novel Security Research? Meet the HTTP Terminator" at @defcon.bsky.social & Black Hat USA! I'm really excited to share this one - got some spectacular outcomes from a wild research journey. See you there!

Next week I'm going to make you terrified of opening your emails...Join me at Black Hat USA for CSS:the bomb inside your inbox

Come and see Tobia from @turtlesec.io and I at @blackhatevents.bsky.social and @defcon.bsky.social next week! We cannot wait to share what we've found!

I haven't posted a crazy XSS vector for a while... Works on every browser

Finding a technique that initially seems to be a one-off "oh cool that worked" case, but then works on other apps with a few small tweaks is what research is all about, and it is so. much. fun. 🔥

Thrilled to announce that @turtlesec.io and I are bringing "CRLF-Powered Desync Attacks: Beheading HTTP Streams" to @defcon.bsky.social. These techniques are producing some truly horrific case studies and we can't wait to share them with you from the main stage!

Asked claude to write a basic scan check for a weird variation of my research topic on my pipeline that I've checked *several* times myself... Instantly spat out another horrendous RQP case. 🤦‍♂️ There is a lesson in here somewhere...

I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer! The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below: jorianwoltjer.com/blog/p/stori... (and thanks @garethheyes.co.uk for making Shazzer!)

Finding XSS on Shazzer (literally) | Jorian Woltjer

How I found an XSS in Shazzer, a tool for discovering and sharing browser quirks through fuzzing. Not *using*, but *in* Shazzer. We'll explore some useful techniques with Blob URLs to unsandbox malici...

jorianwoltjer.com

Gareth Heyes@garethheyes.co.uk · 2mo ago

Just want to say @jorianwoltjer.com is awesome. You'll find out why soon...

i should frame this

back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member in edge, you wouldn't even notice anything out-of-place, and would stay connected to the c2 even after closing the browser

You may have noticed I've been a bit quiet on social media recently, this is why...I'm going to present at Black Hat! Can't wait to present these techniques! Here is a link to the abstract in case the screenshot is hard to read: blackhat.com/us-26/briefi...

Completely flabbergasted... but over the moon to announce with @turtlesec.io that "CRLF-Powered Desync Attacks: Beheading HTTP Streams" is coming to #BHUSA @blackhatevents.bsky.social

Do you have experience in penetration testing, perhaps primarily within web security, and want to continue developing your skills? We are looking for a Senior Penetration Tester to join Assured! Read more and apply: www.assured.se/careers/open... #cybersecurity #pentest #infosec #jobs

Open position: Senior Penetration Tester

We are currently searching for an experienced pentester who wants to strengthen our clients' resilience in today's digital society. You enjoy analysis, testing and digging deep to really understand th...

assured.se

If there's one thing researchers need more of, it's time. Ironically by automating huge parts of the research process, it sounds like you end up with too many new leads... That's a nicer problem to have though 😁.

Patrick Gray@patrick.risky.biz · 3mo ago

If you would like to see a preview of @jameskettle.com's Blackhat talk "the HTTP terminator" then check out this interview my colleague @jameswilson.io recorded with him. Some pretty freaky stuff! VIDEO: www.youtube.com/watch?v=GdFG... AUDIO: risky.biz/RBNEWSSI126/

I just did an interview with @mutantzombie.bsky.social with teasers for my upcoming #BHUSA presentation "Can AI Do Novel Vulnerability Research: Meet the HTTP Terminator", plus reflections on the Top Ten Web Hacking Techniques of 2025 & 2026. Watch it here: www.youtube.com/watch?v=fOWh...

Top 10 Web Hacking Techniques of 2025 and a Hint for 2026 - James Kettle - ASW #380

YouTube video by Security Weekly - A CRA Resource

youtube.com

I'm thrilled to announce "Can AI Do Novel Security Research? Meet the HTTP Terminator" will premiere at Black Hat USA! Check out the abstract: blackhat.com/us-26/briefi...

Me and @t0xodile.com submitted our latest research to DEF CON 34 CFP, hopefully we get to present it on the big stage! But regardless, it's going to be a banger 🔥

The idea that you can go from "0.CL expect-detection v2: 0/200" to a full desync in minutes if the target lets you know that it's running IIS is absolutely bonkers...

Prepping CFPs this year has been a great feeling. Something about actually writing down everything we've discovered / built during research from tooling, novel techniques and even bounties gives you that perspective of what we've actually achieved... Mega excited for this one!

Love it when someone mentions a vuln class to you that sounds cool and then is suddenly applicable in your very next test! SSRF blacklist bypass using DNS rebinding. The Single-packet attack continues to make my stupid race condition ideas a reality.

I'm making a habit of writing down literally any thought that suddenly pops into my head related to research leads. I'm finding it fun to laugh at my own ideas. But all of a sudden, I also have a long list of fun/interesting ideas to try before I need to panic about running out of ideas.

The fact that I can use claude in the background to adjust custom tooling on the fly to test out relatively insane theories on the off chance they work all without losing any measurable time for my actual test is really really powerful.

Spring is just around the corner, and that's when I offer online training courses on Burp Suite Pro 👨‍🏫 Two sessions are planned (in English and French), and there are still a few spots left in each. Contact me to get an early-bird discount code! 💰

Agarri

Training

hackademy.agarri.fr

Our embedded security and cryptography expert Joachim Strömbergson guested a Swedish security podcast (Bli Säker @nikkasystems.com) and discussed Post Quantum Cryptography. Find our English summary and the link to the episode in our blog. www.assured.se/posts/podcas... #pqc #security #cryptography

Podcast Spotlight: The Threat from Quantum Computers

Our embedded security and cryptography expert Joachim Strömbergson guested a Swedish security podcast (Bli Säker) and discussed Post Quantum Cryptography.

assured.se

Going here github.com/vladko312/Re... and implementing a selection / all of these into Backslash-Powered Scanner (or a custom scan check...) is probably very useful. The real work comes from creating a safe but syntactically similar payload for the probe pair. Bring back SSTI!

The voting has concluded, and we're thrilled to announce the top ten web hacking techniques of 2025! Massive thanks to everyone in the community for sharing their hard-earned discoveries, plus the panel and everyone who nominated or voted! portswigger.net/research/top...

Top 10 web hacking techniques of 2025

Welcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

portswigger.net

Got one of our most impactful cases re-opened and accepted after a quick email chain. Always happy to see programs supporting researchers in this way. Going to try writing my reports with a public disclosure section right at the top to see if this helps in these cases.

Spent a long time on a case over the last few weeks getting absolutely nowhere. Remember to try this, instant RQP... I must remember to take my own advise occasionally.

Tom Stacey@t0xodile.com · 9mo ago

Desync issues are so finicky which is exceptionally fun. I really love the fact that at any point "you might be 1 byte away from a desync". However, you can also be a few hundred connections in turbo-intruder away from a desync as it turns out. If in doubt, (carefully) increase your connection pool.

Celebrating 100 #security assessments, over 1000 findings, and over 2000 pages of #pentest reports in 2025! www.assured.se/posts/100-se...

100 Security Assessments in One Year! Looking back at 2025

In 2025, Assured completed 100 security assessments covering many different industries and technologies. Here are the numbers, and what records we’re aiming to break in 2026.

assured.se

Love web & AI security research? Want to do it full time on-site with myself, Gareth Heyes & Zak Fedotkin? Join the PortSwigger Research team - we're hiring! apply.workable.com/portswigger/...