As part of our CVE monitoring, we came across GHSA-pcq9-mq6m-mvmp (CVE-2025-68402), an authentication bypass in FreshRSS, a self-hosted RSS aggregator. It ...
🤯 On the Coming Industrialisation of Exploit Generation with LLMs • 🚨 Cloudflare Zero-day: Accessing Any Host Globally • 🤖 Claude Magic String Denial of Service
I didn't know Harbour even existed as a language when I found this bug. The fun part is that I also ...
🤖 AI models are showing a greater ability to find and exploit vulnerabilities on realistic cyber ranges • 🏴☠️ Pwning Claude Code in 8 Different Ways • 🔐 The State of OpenSSL for pyca/cryptography
💧 Cross-Site ETag Length Leak • 🛠️ Detect Go's silent arithmetic bugs with go-panikint • 💎 Ruby Array Pack Bleed
A quieter week that perfectly fits the two deep dives! 📚 ORM Leaking More Than You Joined For The latest opus ...
SAML bypasses & LLM-assisted crash triage. 🔒 The Fragile Lock: Novel Bypasses for SAML Authentication Ruby SAML falls again. An extraordinary ...
WAF bypasses, CVE research & constant-time crypto. ⏰ Introducing constant-time support for LLVM to protect cryptographic code Trail of Bits explains ...
Articles worth reading discovered last week. This week feels like a giant "how to find your own CVE"... 🤖 An Evening ...
Android, Request Smuggling and Markdown Sanitizer! 📸 Pixnapping Attack It has been a while since the last vulnerability with its own ...
Busy week: Android, Django and MCP! 🤖 Runtime Android Object Instrumentation A great write-up on runtime instrumentation for Android using SQLite ...
Passports, WIFI and AI-SAST! 🛂 The cryptography behind electronic passports A great write-up on the security of electronic passports using a ...
Another great week! 🧠 CSP Bypass Search What if there was a place you could copy/paste a CSP policy and instantly ...