🧩 From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX • 🔥 Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine • 🏭 Countering misuse of AI: September 2026 / Anthropic
🤖 Special Token Injection (STI) Attack Guide • 🪲 MAD Bugs: My Cousin Vinyl (CVE-2026-50052) • 🪲 From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal
With AI, technical interviews are becoming harder and harder to trust. Candidates now have access to automated tools designed to help ...
🖥️ Local AI for Penetration Testing & Research • 🧠 The context an agent needs to find the next vulnerability. • 🤖 The Bug Bounty Singularity: Our Hackbot
I have been travelling to conferences across Europe this year, running workshops and giving talks, mostly on code review and CVE ...
🩹 Introducing Patch the Planet • 🤖 Building an AI pentesting platform • 🤖 Comparing AI Application Security Testing Platforms
🐴 DietrichGebert / ponytail • 🤯 curl summer of bliss • ⛓️ Chaining Security Bugs in Discuz! X5.0: from Race Condition to Pre-Auth RCE
🪲 Jupyter Enterprise Gateway • 🤖 Measuring LLMs’ impact on N-day exploits • 🎆 Bypassing a 3 layer SVG sanitizer: Stored XSS in Mozilla
🔐 Let’s talk about encrypted reasoning • 👏 Golang code review notes II • 🤖 The sorry state of skill distribution
A big part of what I do for PentesterLab is reading CVEs. I spend a lot of time going through them: ...
⚒️ evilsocket / audit • 🤖 Autonomous fuzzing process under LLM supervision • 💰 StubZero: $148,337 RCE in Google Cloud Production
🐚 The React2Shell Story and What Happened Next.js • 🏛️ Mythos finds a curl vulnerability • 🤖 Claude Code RCE: Exploiting Deeplink Handlers via Settings Injection
🤖 AI threats in the wild: The current state of prompt injections on the web • 🪟 Persistence Atlas: 19 Techniques Nobody Talks About • 😳 Securing GitHub: Wiz Research uncovers RCE in GitHub.com