RE: https://mas.to/@patrickbrosset/116809815574070505 🙏🏻 exciting new scripting abilities 🙏🏻 no more boring SOP 🙏🏻 CSS from <img> to style entire page 🙏🏻 big comeback for embedded Java Applets 🙏🏻 SVGZ and ActiveX while we're at it

We updated our public report repository and there is now lots of new material. Here you are, meanwhile 253 pentest reports, summary reports and papers: https://github.com/cure53/Publications/tree/master#publications

Crazy to see that some folks still get paid their salary in money instead of LLM tokens. They gonna spend the money on tokens anyway, why waste time on legacy payment methods from yesteryear??

Fedizens! Please send me your favourite meme which shows something important about the #fediverse I'll go first:

We proudly present — DOMPurify 4.0.0 — the first purely agentic sanitizer 🤖🧼✨ No more rules — no more regex — no more deterministic boredom — Only adaptive intelligence — autonomous decisions — AI-powered sanitation — and the future of XSS prevention — right here — right now 🚀 […]

RE: https://cyberplace.social/@GossiTheDog/116759868416707730 We heard that Twitter/X too is critical for national security and folks outside the US should no longer be able to use it. Facebook as well, no? #securityfirst

Future releases will no longer be able to ignore STML, <ssafe> and the so far quite unknown </lml>. Guess the cat is out of the bag now. This is technically a toot about cats 🐱

What the f*ck is this now, where do those pages come from? https://dompurify.org/ And who creates this... art? https://dompurify.org/wp-content/uploads/2026/03/hero.png

RE: https://mastodon.social/@bagder/116752578588644079 🤨

Small field update... in the past weeks we have seen. * 10+ requests for audits against vibe-coded crypto software & messenger * 1 request for an audit against vibe-coded medical software * 1 request to only use LLMs for audits as there is allegedly too much code for any human to review * […]

DOMPurify 3.4.10 is out, mostly refactoring, should be a bit faster, and a bit more robust. Lots of new tests, documentation etc. Long time to LLM-reported bypasses, maybe things are slowly calming down and we managed to address all exotic config options leading to foot-guns? 🤞🍀 😅 […]

RE: https://infosec.exchange/@catsalad/116702374049795715 Ma! Yo! There's a stray cat outside

The great thing about LLMs is that they make it possible for anyone to create a crypto messenger. All you need is passion and a few tokens. Mega-corporations like Signal can no longer gatekeep and monopolise using their powers - it's finally power to the people!

RE: https://hachyderm.io/@evilpie/116652387705118871 Here is how it all started, like, sort of 😅 https://www.youtube.com/watch?v=KIRvxYqk_Wc

RE: https://infosec.exchange/@timb_machine/116647429206728723 This. It's is mostly where our last three to four weeks have spent with for DOMPurify...

DOMPurify 3.4.7 is out with again several in-depth improvements. If you are using the IN_PLACE config option in production, you might want to go for this one soonish. This is where folks seem to use their Claude tokens for at the moment 😅 https://github.com/cure53/DOMPurify/releases/tag/3.4.7

You probably not gonna like this, yet somewhat might have anticipated... We are seeing a stark influx in requests to audit vibe-coded cryptography. So, vibe-crypto is a thing and will be one for a while. Do what now?

DOMPurify XSS via `selectedcontent` re-clone https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx This is one of the most interesting bypasses we have seen in a long time, and it feels that this new HTML element will cause lots of trouble in the future.

@mespique the magic is explained here https://hellmood.111mb.de//wake_up_16b_writeup.html

Here's a brief overview of the timeline: Yesterday afternoon (CEST), DOMPurify 3.4.4 was released, which allowed the tag <selectedcontent> by default. At 4am CEST today, an email informing us about the bypass was sent by the finder. The <selectedcontent> tag is dangerous and cannot be […]

🚨 DOMPurify 3.4.5 is out, fixing a bypass caused by the <selectedcontent> element, affecting Blink. 🚨 The bypass was reported this morning and a fix release was pushed immediately. https://github.com/cure53/DOMPurify/releases/tag/3.4.5 The DOMPurify 3.4.4 release has been deprecated, an […]

Turns out, the <selectedcontent> element is dangerous.

DOMPurify 3.4.4 is out with again several small in-depth improvements. These include added stability for IN_PLACE sanitization, improved handling of cross-realm nodes and several newly permitted elements and attributes. https://github.com/cure53/DOMPurify/releases/tag/3.4.4

I’ve written a bunch of browser interventions / quirks myself. It’s fun, but it doesn’t scale. You can only do this for really big sites. https://denodell.com/blog/browsers-treat-big-sites-differently

DOMPurify 3.4.3 is out with several smaller improvements. Among them, more robust regex for template scrubbing, better handling of nested Shadow DOM structures, test matrix support for Node 26. https://github.com/cure53/DOMPurify/releases/tag/3.4.3

RE: https://mstdn.social/@mcnado/116558869191191766 Of course, Ivermectin will NOT work against Hantavirus. Unless, that is, you mix it with industry-grade household bleach. Doctors hate this simple trick.

"There are no more juniors. There was a funeral for their passing in 2024. Nobody came. The machine does what they do now, but cheaper. Of course, juniors weren't valuable for what they produced, they were valuable for who they would become: the senior engineer who knows where the bodies are […]

We did not expect that back in 2014 🥹

DOMPurify 3.4.1 is out with lots of small improvements. Among them, a better test suite, a small fuzzer, several fixes and hardenings, and as usually we hope all went well 😅 https://github.com/cure53/DOMPurify/releases/tag/3.4.1

We're already seeing a spike in AI-generated PRs making the ecosystem much more secure. Words cannot describe how grateful we are for all the contributions.

To all the OSS projects getting swamped by AI tickets right now... IT IS TOTALLY YOUR OWN FAULT. The easy fix is to write better code. You are welcome, this advice was free. *ducks*

In anticipation of possibly upcoming waves of OSS bugs as well maybe increasing amounts of real attacks, we have been busy hardening DOMPurify. Look at those shiny badges and improvements, LOOK OMG 😱 https://github.com/cure53/dompurify?tab=readme-ov-file#dompurify Work in progress of course […]

Version 3.4.0 of DOMPurify was released today, addressing a large number of issues reported by LLMs and real people alike. Thanks to all who contributed. https://github.com/cure53/DOMPurify/releases/tag/3.4.0 We hope everything went smoothly and that no one was overlooked in the release notes.

Wondering if anyone has reliable info on the following and would like to share it. Grok, the LLM used by X, now seems to claim that E. Musk never sent any inflammatory messages on June 5 2025 about Trump's involvement on Epstein's Island. Which he probably did. We cannot fact-check this as we […]

Let's address the elephant in the room, shall we? Not a single bug was found by Myhos in Internet Explorer 11. Not a single one. To hell with Open Source, let's go proprietary closed source again and build a moat around our much valued IT assets and lock it all up. Who's laughing now, Anthropic?

We know who Angine de Poitrine really is.

Here's everybody's space heroes having a great time with DJT. https://edition.cnn.com/2026/04/07/science/video/donald-trump-call-artemis-ii-hnk-digvid

🤨 😅 https://blog.trailofbits.com/2026/03/31/how-we-made-trail-of-bits-ai-native-so-far/

Does anyone have a contact at pwn.ai? We would kinda like to have a conversation with them...

DOMPurify 2.5.9 and DOMPurify 3.3.2 were released today in a rush to fix a security issue caused by jsdom's faulty tag parsing. A total of four people reported the exacty same bug within a window of three days. One did so via email, thank you. One did so via private security advisory, thank […]

RIP FX - You are a legend

We have slightly updated the publicly available contract templates for NDA, MSA and DPA. Feel free to, just as before, use them as you see it fit for your own purposes 😄 https://github.com/cure53/Contracts

DOMPurify 3.3.0 is out. You can now configure which tags can have which attributes much more easily. https://github.com/cure53/DOMPurify/releases/tag/3.3.0 Thanks again to everyone who contributed to and supported the project. ❤️

DOMPurify 3.3.0 will soon be released, with this likely being the most important change in a long time: https://github.com/cure53/DOMPurify/pull/1150

How do you like our new website we learned about just today? https://dompurify.com/ Please make sure to run dompurify.exe on Windows 11 for best possible experience and Full HD.

DOMPurify 3.2.7 has been released today, adding several fixes and improvements. https://github.com/cure53/DOMPurify/releases/tag/3.2.7 Thanks to all folks who contributed 💕

Somebody on the internet is very good at subtle humor. #startrektng #humor

In the last five years, we've gone from "employees will never have to go into an office" to "employees need to be in the office because creative and innovative work can only be done face-to-face between humans" to "lol we don't need humans"

libxslt project maintainer steps down, citing the amount of time it takes to triage embargoed security issues. “I’ve been doing this long enough to know that most of the secrecy around security issues is just theater. All the ‘best practices’ like OpenSSF Scorecards are just an attempt by big […]