After uncovering memory bugs in NASA’s CFITSIO, we looked at turning its *documented* features into attack primitives. Check out the blog post for details & a newly released Docker playground to reproduce the demos locally. #AppSec #doyensec #security blog.doyensec.com/2026/05/19/c...

While we're happy for our prize and that our exploit targeting OpenAI's Codex in the Coding Agent category was successful at #PWN2OWN, this was a collision💥 as the bug was previously known to the vendor. Back to the research! #P2OBerlin #doyensec #appsec #security #ai #openai

Proud to share that #Doyensec has 3 unpatched 0day submissions for this year's #PWN2OWN - one for each #AI Coding Agent category target & our #OpenAI Codex exploit was selected for the competition! The other vulnerabilities have been reported to the other vendors. #security

Read how #Doyensec went beyond the basic #AI & web testing to reshape how our client thinks about risks and how we enabled them to evaluate a previously unknown attack surface. It’s amazing when our passion for #appsec has such a big impact! #security www.unit21.ai/blog/risk-de...

Use the Outline wiki? Ensure you have updated to the latest version. The latest coordinated disclosure from our Leonardo Giovannini helped to resolve a stored XSS in the project. Check out the details here: github.com/outline/outl... #doyensec #appsec #security

A great day 1 at DEVWorld Amsterdam is in the books! If you're attending on Friday, stop by our booth and let's talk about how Doyensec can help your team Build With Security! #doyensec #appsec #security #devworld

Check our Adrian Denkiewicz's talk - When Filenames Become Attack Surfaces: Weaponizing NASA’s CFITSIO Extended Filename Syntax, at BSides Luxembourg 🇱🇺, Thurs at 14:45! pretalx.com/bsidesluxemb... #doyensec #appsec #security #bsides #bsidesluxembourg

CloudSecTidbits series is back with a bang! 💥 In the latest edition, we're releasing maSSO - A weaponized Identity Provider (IdP) for security testing! Read all about it and the dangers of Multi-SSO AWS Cognito User Pools. #doyensec #appsec #security blog.doyensec.com/2026/05/05/c...

If you're attending DEVWorld Amsterdam 🇳🇱, stop by our booth to say hello! We'd love to chat about your security projects and show how we help teams "Build with Security"! Looking forward to seeing everyone there! #doyensec #appsec #security #DevWorld

Join #Doyensec at #DEFCON Singapore 🇸🇬 - Demo Labs! Our Mohamed Ouad & Francesco Lacerenza present CloudSec Tidbits: Breaking “Secure-Looking” Cloud Architectures Real-world cloud/AppSec bugs & labs Details - defcon.org/html/defcon-... 🗓 Tue 14:00 | Wed 12:00 | Thu 13:00 #cloudsec #appsec

If you want to ship features faster 🚀, without piling up security debt, make sure to check out our Szymon Drosdzol's presentation at #DevWorld 🇳🇱Amsterdam! Duck Stage 1 - Hall 3, May 7th, 17:00 agenda.devworldconference.com/DevworldConf... #doyensec #appsec #security

In our Adrian Denkiewicz's latest post, see how combining AFL++ with GPT-5 Codex sped up triaging the results from fuzzing NASA’s CFITSIO library and uncovered numerous vulnerabilities. blog.doyensec.com/2026/04/20/c... #doyensec #appsec #security #fuzzing

Please join us in welcoming **Matei Buzdea** as the newest intern at Doyensec! 🎉 They’re the latest in a long line of talented interns who’ve helped strengthen our team and we’re excited to see what they’ll accomplish. Welcome aboard, Matei! 🔐 #doyensec #appsec #security #internship

🚨 Breaking Secure-Looking Cloud Architectures At #defcon Singapore Demo Labs, we'll show real cloud security bugs involving AWS Cognito multi-SSO user pools & ELB routing paths. Including: • Malicious OIDC Server • ELBaph (AWS ELB testing utility) 🔗 defcon.org/html/defcon-... #appsec #doyensec

📢 #Doyensec is sponsoring DEV World! We'll be at our booth discussing security research & how to "Build with Security" directly with the #dev community. Stop by - we'd love to chat! 🗓 May 7–8 | 📍 Amsterdam, Netherlands 🇳🇱 devworldconference.com #DevWorld #AppSec

Did you know you can use #InQL to recreate #GraphQL schema even when the introspection query is disabled? Our Schema Bruteforcer ensures "hidden" doesn't actually mean "off-limits". Find out more at: blog.doyensec.com/2025/12/02/i... github.com/doyensec/inql #doyensec #appsec #security

AuthN/Z is always a #security minefield & MCP adds even more complexity with agents, remote servers, and transitive trust. This Teleport-sponsored deep dive breaks down attack vectors & why each authN/Z step is a potential trust boundary. 🔗 blog.doyensec.com/2026/03/05/m... #doyensec #appsec #ai

Check out the latest edition of @pagedout.bsky.social featuring Doyensec's own Bartłomiej (Bartek) Górkiewicz vibing on Reversing Python Bytecode, along with plenty of great articles! pagedout.institute/download/Pag... #appsec #doyensec #security #reversing #pagedout

Testing APIs? Stop guessing what's running under the hood. Use InQL's Engine Fingerprinter in Burp to identify the #GraphQL stack in seconds and save yourself the trial and error. blog.doyensec.com/2025/12/02/i... github.com/doyensec/inql #doyensec #appsec #inql #security #bugbountytips

Introducing SafeUpdater by Michael Pastor - A security-first update framework for Electron apps, built around explicit threat models, integrity and authenticity guarantees, and real attack mitigations. Check it out today! blog.doyensec.com/2026/02/16/e... #AppSec #Electron #doyensec #security

If you missed our Szymon Drosdzol's presentation on "API Authorization Antipatterns" at CONFidence (@confidenceconf), or just want to see it again, it's your lucky day! The video is now available here: www.youtube.com/watch?v=Jje2.... Hope you enjoy it! #appsec #doyensec #security

Humans vs. AI? We put them to the test in our new post! We went head-to-head with AI tools to see who would win? Check it out today to see the results! blog.doyensec.com/2026/02/03/o... #appsec #doyensec #outline #ai

Set your #xss hunting 🎯 on easy mode! In the latest edition of our Eval Villain video series, Dennis Goodlett demonstrates the time-saving power of the "needles" feature. youtu.be/LI9QOuQDduE #appsec #doyensec #bugbountytips #security

🥳Doyensec is proud to announce our sponsorship of the UC Davis Cyber Security Club!💻🔐 We're committed to supporting the next generation of #cybersecurity talent 📚🧗 daviscybersec.org/sponsors/ #appsec #doyensec #infosec #ucdavis

In our latest blog post, Szymon Drosdzol provides an in-depth walkthrough of using the #frida toolkit to demonstrate the right way to intercept OkHTTP traffic. This is essential knowledge for #android security research! Check it out: blog.doyensec.com/2026/01/22/f... #appsec #doyensec #security

🎉 We'd like to welcome our newest intern (and second Luca), Luca Molteni! We're confident he'll be the next amazing engineer to emerge from our proven internship program. 🚀 #appsec #doyensec #security #internship

📢Just published - the third video in our series on Eval Villain. Our Dennis Goodlett walks through using it to find 🔎 a DOM XSS to demonstrate its functionality. Check it out today! youtu.be/Hp7TexA6vFg #appsec #doyensec #security #evalvillain #xss

In the second post on Eval Villain, @bemodtwz walks through the quick & easy setup and its configuration. Check it out & start finding those client-side vulnerabilities today! youtu.be/-hIA5uLNFck Download: github.com/swoops/eval_... #appsec #doyensec #security

Happy New Year from the #Doyensec team!

🥂🤖 A toast to 9 years of #Doyensec! Nine years of pushing application security forward, breaking things so others don’t, & helping teams build with security from day one. 🍸 Cheers to the bugs we’ve found, the apps we’ve strengthened, & the many secure years still to come. 🎉

Happy Holidays everyone!☃️ We’re taking a break next week for our annual shutdown to celebrate another successful year and give our team time to recharge. 🙌 #doyensec #appsec #security

We’re excited to share the first video in our Eval Villain series from our Dennis Goodlett. This powerful security tool is designed to uncover client-side vulnerabilities and help defenders spot risky patterns. youtu.be/2dUoOyYKkzU #doyensec #appsec #security #evalvillain #xss

🚀 inQL v6.0.1 is out! Our GraphQL security tool got big upgrades.⚡ • Schema Brute-Forcer • Server Engine Fingerprinting • Automatic Variable Generation • Performance boosts & other improvements Details: blog.doyensec.com/2025/12/02/i... #doyensec #graphql #appsec #security

We’re proud that #Doyensec was selected to help secure the IETF — and to share the first batch of vulnerabilities we uncovered. Read more in the newly published advisories 👇 github.com/ietf-tools/x... github.com/ietf-tools/x... #appsec #security

We’re super excited to welcome Yassine Bengana to the Doyensec team! 🎉 He’s bringing serious AppSec skills and great vibes — can’t wait to see the cool stuff we’ll break (and build) together 🔥 #AppSec #infosec #Doyensec

The #Doyensec team is back from another great retreat! This time we toured Ireland 🇮🇪 and even met a working 🐑 sheep dog ! What a great chance for our remote team to connect IRL! Also, a big thank you 🙏 to our tour guide Antonio! #security #appsec #remote

Going to be near Dublin this Wednesday (10/22)? come join #Doyensec for an evening of drinks ( 🍻/☕ ), networking, and great conversations about all things #appsec & #cybersecurity. RSVP here: docs.google.com/forms/d/1fa4... #Infosec #Pwn2Own #BSidesDublin #OWASPIreland #security

🚨 Just released - details on a serious vulnerability from our Leonardo Giovannini's research! An Information Disclosure allowing a remote attacker to identify security tokens/credentials when #squid is used for load balancing.🚨 #doyensec #appsec #security #vulnerability github.com/squid-cache/...

Live in or passing through #Dublin enroute to #pwn2own ? If you're in #appsec join #doyensec to talk #security over drinks (🍺 or ☕️) Oct. 22nd! Want to talk about our job openings or upcoming projects, that's great too! RSVP here: docs.google.com/forms/d/1fa4... cc: @bsidesdublin.bsky.social

In our final ksmbd research post @73696e65.bsky.social provides a detailed walkthrough for exploiting a local privilege escalation vulnerability. If you're interested in learning more about exploitation on modern systems - check it out! blog.doyensec.com/2025/10/08/k... #doyensec #appsec #security

🧞Your wish has been granted - the latest @pagedout.bsky.social edition is out! In it, our Szymon Drosdzol takes a quick look at #vibecoding, walking through the creation of an AI agent 🤖. Check it out today! #doyensec #appsec #ai #Security pagedout.institute

📢 Our latest blog post shows why VBScript’s Randomize + Rnd are terrible for cryptographic token generation. See how attackers can easily recover seeds and secrets. 🔗 blog.doyensec.com/2025/09/25/y... #doyensec #appsec #security #crypto

🚨Security Advisory🚨 Systemic SQL Injection vulnerability in pREST! Initial report details published: github.com/prest/prest/... #Doyensec #AppSec #Security #PostgreSQL #SQLInjection

We'd like to welcome our newest addition Marcelino "Marce" Siles Rubia! Another success story from our #internship program! The future of #appsec is looking bright 😎 at #doyensec !

📢 It's here! Part 2 of Norbert Szetei's (@73696e65.bsky.social) research into ksmbd. See how customized fuzzing & the appropriate sanitizers led to discovering 23 Linux kernel CVEs, including use-after-frees & out-of-bounds reads/writes. blog.doyensec.com/2025/09/02/k... #doyensec #appsec #security

📖 Read about a real-world C# #cryptography vulnerability we've discovered in the wild, in our latest blog post! No math required (unless you're into that sort of thing)! blog.doyensec.com/2025/08/19/t... #doyensec #appsec #security #csharp

Are you located in the US/EU? passionate about #appsec? Maybe you follow #bugbountytips or are an avid #ctf player and are ready to take the next step. If so, we're looking for our next #intern, so consider applying today - hackers.doyensec.com. #doyensec #security #internship

🚨Security Advisories🚨: multiple vulnerabilities in Retool, including host header injection and CSRF - discovered by Doyensec and the Robinhood Red Team! docs.retool.com/disclosures/... docs.retool.com/disclosures/... #doyensec #appsec #security #retool #robinhood

Our latest 🚨Security Advisory🚨 includes multiple vulnerabilities affecting the immersed platform. The findings include an RCE via Session Overwriting, an RCE via CSRF and a Privilege Escalation flaw. Read the details here: www.doyensec.com/resources/Do... #doyensec #appsec #security

Just published - Our new white paper comparing Semgrep's Code and Community editions! We dove into both versions of this popular tool to see what the differences were and how they performed against each other. Check it out! www.doyensec.com/resources/Co... #doyensec #appsec #security #semgrep