Spoke at BlueHat IL and had an amazing time! I was able to deliver my talk, and I think it went really well, super excited to speak in front of such an incredible audience! Great seeing Alexander Georgiev again! Some pictures from the event below📸

[RSS] Blasting Past Webp googleprojectzero.blogspot.com -> An analysis of the NSO BLASTPASS iMessage exploit Original->

This is so cool: The LibAFL_QEMU ASan implementation was ported to rust github.com/AFLplusplus/... #LibAFL #QEMU #ASan #Rust

Created a #CodeQL Cheat Sheet to document what I struggled with recently: scrapco.de -> Will push updates as they pop to my mind. Contributions/ideas are also most welcome! github.com -> Original->

This article on Solr and its (in)security is really good 💎 And I strongly recommend to read @hacefresko.com previous article on Solr before diving in this one (I will share the link in my reply)

Quick fix for Ghidra's rust detection, if you are analyzing rust and your strings are not extracted correctly please try my patch! github.com/NationalSecu... #Ghidra #RustLang #Malware #ReverseEngineering

We've just released Shadow Repeater, for AI-enhanced manual testing. Simply use Burp Repeater as you normally would, and behind the scenes Shadow Repeater will learn from your attacks, try payload permutations, and report any discoveries via Organizer. portswigger.net/research/sha...

[RSS] Ungarble: Deobfuscating Golang with Binary Ninja invokere.com -> Original->

Bluesky is the vaping of social media. It got me off the really bad stuff, and definitely tastes better, but it's probably still not great for my health.

It's live! Starting today, you can use @cyd.social to migrate your old tweets into Bluesky. Check it out! cyd.social/migrate-your...

You can find our @shmoocon.bsky.social presentation slides at the below GitHub repo. Thanks again to all that attended. Also, thank you to the conference organizers for putting on a great con and having us! #shmoocon github.com/h4wkst3r/Con...

A VM escape exploit chain, exploited in the wild as 0day ...well that's not something we see very often 👀

Here’s the first article: www.hacefresko.com/posts/unrest...

Good news! I've uploaded a new post about the most complex and beautiful vulnerability I've ever found, involving patching and uploading deprecated .jar libraries to get RCE on a big target. It's a very technical post, but I hope you like it ! :) www.hacefresko.com/posts/rce-on...

We’re proud to announce that @adrian-rt.bsky.social will speak at BlueHat IL 2025 by @microsoft.com on April 8 in Tel Aviv! Our participation reinforces our position as a leader in pentesting and reflects our mission to enhance cybersecurity through cutting-edge research and real-world insights.

We've updated our URL validation bypass cheat sheet with this shiny Domain allow list bypass payload contributed by dyak0xdb!

Qualys Security Advisory CVE-2025-26465: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client CVE-2025-26466: DoS attack against OpenSSH's client and server www.openwall.com -> Original->

Catch the inside story on the Top Ten Web Hacking Techniques in my interview with the Application Security Weekly podcast youtu.be/8XEK3NkbKOA

My bad, I forgot to post a link to last week's edition of AppSec Ezine 🤦 pathonproject.com/zb/?e8f4f080...

OMG, Orange Tsai released his latest new research 🤯 💣 blog.orange.tw/posts/2025-0...

Networking in InfoSec isn’t just about IP addresses and ports—it’s also about people! Discover how meetups, conferences, and volunteering can open big career doors in InfoSec. Read more: pentesterlab.com/blog/infosec...

If you haven't seen the Honey tech drama you absolutely have to, it's awesome! youtu.be/vc4yL3YTwWk

No polyglots or tricks, just the basics for now. This will be recorded and available publicly later. m.youtube.com/@corkami-alb...

AWS published CVEs on Christmas Eve. 🎅 Their Redshift library is vulnerable to SQL injection, but only one minor version that was released a month ago. aws.amazon.com/security/sec...

🎅 pentesterlab.com/gift/v5kegJq... (3-month) pentesterlab.com/gift/4VG6RYU... (3-month) pentesterlab.com/gift/lsgfEwJ... (3-month)

I just….

These are some really nice blog posts regarding algo confusion bugs in JWT by @pentesterlab.com pentesterlab.com/blog/jwt-alg... & pentesterlab.com/blog/another... nice one @snyff.pentesterlab.com!

I sometimes get asked why I still wear an analog wristwatch. It's true that I don't need it. But it is a symbol of a certain level of sophistication and class.

Just thinking… If there’s no chunked responses in HTTP/2, could HTTP/1 be more efficient for race conditions which don’t require perfect parallelism but instead very small intervals (à la phpinfo+LFI)? 🧐

OpenAI o3 model just achieved unbelievable scores (75% and 87%) on ARC-AGI, the previous models made maximum 20% and humans make around 85%. arcprize.org/blog/oai-o3-...

🚀 Exciting news! Showcase your skills at the 2025 #OWASP Global #AppSec EU conference in vibrant Barcelona! The Call for Trainers is officially OPEN! Don't let this chance slip away. Submit your proposal today to inspire fellow enthusiasts: sessionize.com/owasp...#OWASP#AppSec#cybersecurity #devsecops #AI

In case you're a professional Burp Suite user, there's a few seats left for the Q1 2025 training sessions hackademy.agarri.fr/2025