We’re proud that #Doyensec was selected to help secure the IETF — and to share the first batch of vulnerabilities we uncovered. Read more in the newly published advisories 👇 github.com/ietf-tools/x... github.com/ietf-tools/x... #appsec #security

We’re super excited to welcome Yassine Bengana to the Doyensec team! 🎉 He’s bringing serious AppSec skills and great vibes — can’t wait to see the cool stuff we’ll break (and build) together 🔥 #AppSec #infosec #Doyensec

The #Doyensec team is back from another great retreat! This time we toured Ireland 🇮🇪 and even met a working 🐑 sheep dog ! What a great chance for our remote team to connect IRL! Also, a big thank you 🙏 to our tour guide Antonio! #security #appsec #remote

Going to be near Dublin this Wednesday (10/22)? come join #Doyensec for an evening of drinks ( 🍻/☕ ), networking, and great conversations about all things #appsec & #cybersecurity. RSVP here: docs.google.com/forms/d/1fa4... #Infosec #Pwn2Own #BSidesDublin #OWASPIreland #security

🚨 Just released - details on a serious vulnerability from our Leonardo Giovannini's research! An Information Disclosure allowing a remote attacker to identify security tokens/credentials when #squid is used for load balancing.🚨 #doyensec #appsec #security #vulnerability github.com/squid-cache/...

Live in or passing through #Dublin enroute to #pwn2own ? If you're in #appsec join #doyensec to talk #security over drinks (🍺 or ☕️) Oct. 22nd! Want to talk about our job openings or upcoming projects, that's great too! RSVP here: docs.google.com/forms/d/1fa4... cc: @bsidesdublin.bsky.social

In our final ksmbd research post @73696e65.bsky.social provides a detailed walkthrough for exploiting a local privilege escalation vulnerability. If you're interested in learning more about exploitation on modern systems - check it out! blog.doyensec.com/2025/10/08/k... #doyensec #appsec #security

🧞Your wish has been granted - the latest @pagedout.bsky.social edition is out! In it, our Szymon Drosdzol takes a quick look at #vibecoding, walking through the creation of an AI agent 🤖. Check it out today! #doyensec #appsec #ai #Security pagedout.institute

📢 Our latest blog post shows why VBScript’s Randomize + Rnd are terrible for cryptographic token generation. See how attackers can easily recover seeds and secrets. 🔗 blog.doyensec.com/2025/09/25/y... #doyensec #appsec #security #crypto

🚨Security Advisory🚨 Systemic SQL Injection vulnerability in pREST! Initial report details published: github.com/prest/prest/... #Doyensec #AppSec #Security #PostgreSQL #SQLInjection

We'd like to welcome our newest addition Marcelino "Marce" Siles Rubia! Another success story from our #internship program! The future of #appsec is looking bright 😎 at #doyensec !

📢 It's here! Part 2 of Norbert Szetei's (@73696e65.bsky.social) research into ksmbd. See how customized fuzzing & the appropriate sanitizers led to discovering 23 Linux kernel CVEs, including use-after-frees & out-of-bounds reads/writes. blog.doyensec.com/2025/09/02/k... #doyensec #appsec #security

📖 Read about a real-world C# #cryptography vulnerability we've discovered in the wild, in our latest blog post! No math required (unless you're into that sort of thing)! blog.doyensec.com/2025/08/19/t... #doyensec #appsec #security #csharp

Are you located in the US/EU? passionate about #appsec? Maybe you follow #bugbountytips or are an avid #ctf player and are ready to take the next step. If so, we're looking for our next #intern, so consider applying today - hackers.doyensec.com. #doyensec #security #internship

🚨Security Advisories🚨: multiple vulnerabilities in Retool, including host header injection and CSRF - discovered by Doyensec and the Robinhood Red Team! docs.retool.com/disclosures/... docs.retool.com/disclosures/... #doyensec #appsec #security #retool #robinhood

Our latest 🚨Security Advisory🚨 includes multiple vulnerabilities affecting the immersed platform. The findings include an RCE via Session Overwriting, an RCE via CSRF and a Privilege Escalation flaw. Read the details here: www.doyensec.com/resources/Do... #doyensec #appsec #security

Just published - Our new white paper comparing Semgrep's Code and Community editions! We dove into both versions of this popular tool to see what the differences were and how they performed against each other. Check it out! www.doyensec.com/resources/Co... #doyensec #appsec #security #semgrep

Several members of the @doyensec.bsky.social team are heading to @tumpicon.org 🇮🇹 for our Norbert Szetei's (@73696e65.bsky.social) presentation on his awesome ksmbd security research. If you're around, make sure to talk to Luca Carettoni & the team! #doyensec #appsec #TumpiCon tumpicon.org

🚀 We have just released a new Security Advisory for @NASA's CFITSIO library 🛰️. Click the link for details on the Heap Overflow, Type Confusion, Out-of-Bound Writes & other vulnerabilities discovered by our Adrian Denkiewicz ! www.doyensec.com/resources/Do... #doyensec #appsec #security

Thanks to inspiration and support from Teleport, Doyensec is proud to release the Security Policy Evaluation Framework, an open source tool for testing security policy engines! github.com/gravitationa... #doyensec #appsec #rigo #cedar #openfga #security

🚨Just posted🚨: Learn about real-world API authorization vulnerabilities we frequently see with the slides from Szymon Drosdzol's recent presentation at the CONFidence conference in Krakow. doyensec.com/resources/CO... #doyensec #appsec #security

We'd like to welcome 👋 Marcelino Siles Rubia as our latest Application Security Intern. Welcome aboard! 🎉 #doyensec #appsec #internship

Attending CONFidence conference in Krakow 🇵🇱 this weekend? Be sure to check out our Szymon Drosdzol's presentation - API Authorization Antipatterns: confidence-conference.org/lecture-2025... #doyensec #appsec #confidencecon

Several members of the #doyensec team are here in Berlin 🇩🇪attending 🎯Offensive Con 🎯 this weekend! Ping us or just say "hallo" in person, if you'd like to talk #appsec or grab a coffee. We're looking forward to some amazing talks! #offensivecon #security

🚨 Advisory Alert!🚨 We've just published our Aleandro Prudenzano's advisory (in cooperation with Edoardo Geraci) regarding a heap overflow in HAProxy. Read all the details here: www.doyensec.com/research.htm... #doyensec #appsec #security #haproxy

We'd like to welcome the latest member of our team - Diego Perez, our new Application Security Intern! Welcome aboard! 🎉 #doyensec #appsec #security #internships

Going beyond SSO, our Francesco Lacerenza decided to take a deep dive into SCIM in our latest blog post. Read it today to learn how including this user identity standard in your next test's scope can reap big rewards! blog.doyensec.com/2025/05/08/s... #doyensec #appsec #security #scim

Our Norbert Szetei's latest research has resulted in at least 1⃣5⃣ CVEs in ksmbd🤯, including multiple use-after-frees, bounds checks, type confusion and overflows‼️ Check it out today! www.doyensec.com/research.htm... #doyensec #appsec #security #linux

Thanks to all the people who make @BSSidesSF happen every year. We're always happy to sponsor such a great conference! All of the #Doyensec team who attended had a great time! See you next year! #bsides #bsidessf

If you're attending #BSidesSF, make sure to stop by the Doyensec booth and say hello! You'll find several our team members in the vendor area and throughout the conference! #doyensec #appsec #security #bsides

The #Doyensec team is proud to sponsor BSidesSF again this year ! If you're in the 🌉San Francisco🌉 area this weekend come meet several of our team members in person 🫂! Plus, stop by our booth for a chance to win a Flipper Zero 🐬! #appsec #security #bsidessf #flipperzero

📢 Upset about losing CVE data? We dropped these new 🔥 critical #ComfyUI vulnerabilities, including this RCE, to cheer you up 😉. These are published as part of our coordinated disclosure process. www.doyensec.com/resources/Do... #doyensec #appsec #security

In the Pisa 🇮🇹 area this weekend? Stop by the Google Developer Group's #DevFestPisa 2025 to catch our Aleandro Prudenzano's presentation - "Imparare la cybersecurity catturando bandiere" (Learn Cybersecurity by Capturing Flags 🚩). www.eventbrite.it/e/devfest-pi... #Doyensec #AppSec #GDG #security

🚀 #InQL v6.0 is here! A full Kotlin rewrite with improved performance and responsiveness! 🆕 Built-in GraphiQL & #GraphQL Voyager visualization regardless of the target 🆕 Circular references detector 🆕 Improved batch queries screen 🚀 SPEED! #doyensec #appsec github.com/doyensec/inq...

As a follow up to @maxenceschmitt.bsky.social's amazing #CSPT research, we've published a list of resources to help people interested in this class of vulnerabilities. Check it out today for video, tools, challenges and variety of publications! blog.doyensec.com/2025/03/27/c... #Doyensec #appsec

🥳The latest !exploitable is here! We're sharing all the joy that comes with exploiting an arbitrary file write in GitLab, while cruising the Mediterranean. 🚢 Everything from onerous configurations to spotty internet! Enjoy! #doyensec #appsec #security blog.doyensec.com/2025/03/18/e...

Join us in welcoming Michael Pastor back to the team! He's returning to #Doyensec following his internship! We pride ourselves on the fact that all of our past interns have transitioned to an Application Security Engineer with us. #appsec #security #internship

Knock, knock, everyone. 🐇 Want to see how far the rabbit hole goes? Check out our latest blog post where we walk you through exploiting one of the most famous vulnerabilities ever - while on a cruise! 🛥️ blog.doyensec.com/2025/03/04/e... #doyensec #appsec #security

We're looking for a promising intern in the US or EU to join our team this summer! Sharpen your skills & develop new ones alongside the best, while performing real-world testing & application security research. Learn more today at hackers.doyensec.com! #doyensec #appsec #security #internship

Ahoy! 🦜 Our first "!exploitable" post provides a technical dive 🤿 into the sea 🌊 of IoT exploitation. Read it today to learn how our team 🏴‍☠️ developed an exploit while floating in the Mediterranean! blog.doyensec.com/2025/02/11/e... #doyensec #appsec #security #iot #exploits

🎉 PESD v2.0 is now in the BApp store! Effortlessly generate dynamic sequence diagrams directly from BurpSuite traffic! Now you can also create your own theme, conveniently edit the generated diagrams with MD syntax and much more! Install it today! 🎉 #doyensec #appsec #burpsuite #security

🎉 Join us in welcoming Alessandro Versari to the #Doyensec team! 🎉

Despite being central to their security, many orgs struggle to securely implement #OAuth. Our new post walks through common issues & how to prevent them, along with a useful checklist! Read it today & ensure your OAuth is secure: blog.doyensec.com/2025/01/30/o... #doyensec #security #appsec #dev

Following our attempts to contact the casdoor maintainers, we're releasing an advisory regarding their software. This vulnerability allows attackers to exfiltrate data from the identity provider (IdP) or obtain access over SCIM. Details here: doyensec.com/resources/Do... #doyensec #appsec #security

Following our attempts to contact Productlane, we're releasing an advisory regarding their platform. This vulnerability has the potential to allow attackers to obtain a client's Slack API token. You'll find all the details here: www.doyensec.com/resources/Do... #doyensec #appsec #security

📜Hear ye, hear ye! 📜 We're proud to announce our ongoing sponsorship of BSides SF ! Doyensec ⚔️ will be onsite 🏰 and we hope to see you there April 26-27th (details: bsidessf.org)! 🐉 #BsidesSF #Doyensec #BSides #Security

Nice to see @maxenceschmitt.bsky.social's CSPT research (a nominee for #Portswigger's top 10 web hacking techniques for 2024) getting a shout out on the Critical Thinking Bug Bounty podcast ! Check out the review and comments here: youtu.be/3rkg1CUDpjA?... #doyensec #appsec #security #CSPT2CSRF

This year, #Doyensec is excited to have 4⃣ great nominations in @portswiggerres.bsky.social's Top 10 web hacking techniques! 🥳 Check them all out and vote for your favorites (ours🤞) today! portswigger.net/research/top... #appsec #security #portswigger

Taking his previous research to the next level, our Maxence Schmitt explores how to bypass various upload restrictions to exploit client-side path traversal. Read about it in our latest blog post today! blog.doyensec.com/2025/01/09/c... #doyensec #appsec #cspt #cspt2csrf

In the latest Doyensec research, our Norbert Szetei takes a closer look at the SMB3 Kernel Server (ksmbd) component of the Linux kernel. Check it out today to learn what he found, which led to multiple CVEs! #Doyensec #Appsec #Security #Linux blog.doyensec.com/2025/01/07/k...