New badge: JavaScript Sandbox Escape! The first 4 labs are live. If you ship anything that evaluates untrusted or model-generated JavaScript, this badge is for you: pentesterlab.com/badges/javas...

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟯, 𝟮𝟬𝟮𝟲 Only one entry but definitely worth reading! ☁️ 𝗥𝗲𝗺𝗼𝘁𝗲 𝗖𝗼𝗺𝗺𝗮𝗻𝗱 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 𝗶𝗻 𝗚𝗼𝗼𝗴𝗹𝗲 𝗖𝗹𝗼𝘂𝗱 𝘄𝗶𝘁𝗵 𝗦𝗶𝗻𝗴𝗹𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗗𝗲𝗹𝗲𝘁𝗶𝗼𝗻 This one is a real tour de force: flatt.tech/research/pos....

🧑‍🎓 Learning of the day for me, once again thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation). #appsec #appsecurity

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟮, 𝟮𝟬𝟮𝟲 AI doing research, AI killing CTF 🤖 𝗧𝗲𝘀𝘁𝗶𝗻𝗴 𝗔𝗜 𝗳𝗼𝗿 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝟰 𝗔𝗽𝗽𝗿𝗼𝗮𝗰𝗵𝗲𝘀 & 𝗪𝗵𝗲𝗿𝗲 𝗜 𝗙𝗮𝗶𝗹𝗲𝗱 If you can only read one thing this week, make it this article: xclow3n.github.io/post/7.

🧑‍🎓 Learning of the day for me thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation): #appsec #appsecurity

A commit meant to "strengthen the crypto" in FreshRSS ended up removing the need for a correct password. Why? Longer SHA-256 nonce + bcrypt truncation at 72 bytes. A nice example of why secure systems are about composition, not just stronger primitives. pentesterlab.com/blog/freshrs...

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟬, 𝟮𝟬𝟮𝟲 A great mix of content this week! 🔒 𝗜𝗿𝗼𝗻𝗖𝘂𝗿𝘁𝗮𝗶𝗻: 𝗔 𝗣𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗔𝗜 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗕𝘂𝗶𝗹𝘁 𝗦𝗲𝗰𝘂𝗿𝗲 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗚𝗿𝗼𝘂𝗻𝗱 𝗨𝗽 Niels Provos (from OpenBSD's systrace) is sharing a new tool to sandbox your AI assistant: www.provos.org/p/ironcurtai....

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟵, 𝟮𝟬𝟮𝟲 Mostly AI... 💻 𝗕𝗿𝗼𝘄𝘀𝗲𝗿-𝗕𝗮𝘀𝗲𝗱 𝗣𝗼𝗿𝘁 𝗦𝗰𝗮𝗻𝗻𝗶𝗻𝗴 𝗶𝗻 𝘁𝗵𝗲 𝗔𝗴𝗲 𝗼𝗳 𝗟𝗡𝗔 Leveraging Local Network Access to create a port scanner! wiki.notveg.ninja/tools/lna-po....

6 new code review labs just dropped 🚀 +3 for JavaScript Code Review +3 for Python Code Review JS: pentesterlab.com/badges/javas... Python: pentesterlab.com/badges/pytho...

As I mentioned last week I ordered some books (which got delivered this week) CVE ARCHEOLOGIST'S FIELD GUIDE by Louis Nyffenegger @pentesterlab.com

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟴, 𝟮𝟬𝟮𝟲 Java x2, Go, JWT and a sprinkling of AI 🦫 𝗖𝗧𝗙𝘁𝗶𝗺𝗲.𝗼𝗿𝗴 / 𝗷𝘂𝘀𝘁𝗖𝗧𝗙 [*] 𝟮𝟬𝟮𝟬 / 𝗚𝗼-𝗳𝘀 / 𝗪𝗿𝗶𝘁𝗲𝘂𝗽 A cool Golang quirk via an unintended CTF solution ctftime.org/writeup/25852.

New lab: CVE-2026-24895 — FrankenPHP Path Confusion RCE (Unicode) People think "lowercase it" is harmless. In Unicode it’s not. Case folding can do weird mappings (Turkish i, Kelvin sign…), and sometimes worse: UTF-8 byte length changes. Hands-on lab: pentesterlab.com/exercises/cv...

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟳, 𝟮𝟬𝟮𝟲 Parser Differential, TypeScript and AI 👇

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟲, 𝟮𝟬𝟮𝟲 Busy week! AI, AI, AI and the death of Flash! 🤖 𝗦𝗲𝗺𝗴𝗿𝗲𝗽'𝘀 𝗔𝗴𝗲𝗻𝘁 𝗦𝗸𝗶𝗹𝗹𝘀 Semgrep released a set of agent skills worth looking into: github.com/semgrep/skills.

🧑‍🎓 Learning of the day for me thanks to @pentesterlab.com and Claude. 🔬 For the regular expression "[A-z]": In a character class [X-Y], it matches all characters with ASCII codes from X to Y inclusive. So [A-z] means all ASCII characters from 65 (A) to 122 (z). #appsec #appsecurity

MORE LABS IN OUR JAVASCRIPT CODE REVIEW BADGE: pentesterlab.com/badges/javas...

Research Worth Reading - Week 5, 2026 Bugs EVERYWHERE….

🔥 CVE-2026-23993: HarbourJwt JWT auth bypass via unknown alg. Not just alg=none: unsupported alg => empty signature, so forged token header.payload. passes. Write-up + fix: pentesterlab.com/blog/cve-202...

Research Worth Reading Week 03/2026 Claude RedTeam, Claude Hacking, Claude Skills...Is it Claude week? 🤖 AI models are showing a greater ability to find and exploit vulnerabilities The latest Claude models are getting noticeably better at hacking: red.anthropic.com/2026/cyber-t...

Happy New Year! Research Worth Reading Week 01/2026! 💧 Cross-Site ETag Length Leak An amazing CTF write-up on XS Leaks. Make sure you also read the unintended solution linked at the bottom of the page: blog.arkark.dev/2025/12/26/e...

A surprise from @pentesterlab.com

Research Worth Reading Week 51/2025 A quieter week that perfectly fits the two deep dives! 📚 ORM Leaking More Than You Joined For The latest opus in Elttam's posts on ORM leaks, including some semgrep rules and a reference to my blog post on the subject: www.elttam.com/blog/leaking...

Research Worth Reading Week 50/2025: SAML bypasses & LLM-assisted crash triage. 🔒 The Fragile Lock: Novel Bypasses for SAML Authentication Ruby SAML falls again. An extraordinary exploit by the PortSwigger team: portswigger.net/research/the...

🧑‍🎓 Learning of the day for me thanks to: - @pentesterlab.com for the presentation of the behavior and the code review lab. - ChatGPT for the detailed explanation. #appsec #appsecurity #python

I just completed @pentesterlab.com 's Recon Badge!!!

Welcome back to Slytherin! 🐍 We just released 3 new labs in our python^w Slytherin code review badge: real CVEs, sneaky bugs, and plenty of chances to sharpen your dark code arts.. Grab your wand here: pentesterlab.com/badges/pytho...

Research Worth Reading Week 49/2025: ⏰ Introducing constant-time support for LLVM to protect cryptographic code Trail of Bits explains their work on adding constant-time support to LLVM so that compiled cryptographic code remains constant-time: blog.trailofbits.com/2025/12/02/i...

Black Friday at @pentesterlab.com 🧨 For a limited time: 🔒 1 year of PRO for $146.52 🎓 Student special: 3 months PRO for $25.99 Hands-on labs. Real CVEs. Security code review training used by real AppSec & pentest teams. ⏰ Offer ends 2 Dec 2025, 23:59:59 UTC 👉 pentesterlab.com/pro

Added 3 new Java CVEs to our Java Code Review Badge! Now at 64 real-world labs to sharpen your Java code review skills. Try them here: pentesterlab.com/badges/java-... More CVEs coming soon 👀🔥

Articles worth reading discovered last week: 📲 security.googleblog.com/2025/11/rust... 📸 www.pixnapping.com 🧩 www.praetorian.com/blog/how-i-f... 🤖 buganizer.cc/hacking-gemi...

😂 @pentesterlab.com #Kawaiicon @kawaiicon.bsky.social

Research to read this week: Android, Django, MCP… 🤖 knifecoat.com/Posts/Runtim... 🐍 www.endorlabs.com/learn/critic... 🌽 googleprojectzero.blogspot.com/2025/11/defe... 🤖 medium.com/@kulkan-secu... 🧑🏻‍💻 words.filippo.io/claude-debug... #PentesterLabWeekly

Don't just look at bad code Know what good looks like! @pentesterlab.com #Kawaiicon @kawaiicon.bsky.social

Articles worth reading discovered last week: Passports, WIFI and AI-SAST! 🛂 blog.trailofbits.com/2025/10/31/t... 🛜 pulsesecurity.co.nz/articles/byp... 🧠 parsiya.net/blog/wtf-is-...

Yeah @nastystereo.com I think you and @pentesterlab.com would get along just fine collabbing. 👀

Upgrading the designer bag with a necessary accessory @pentesterlab.com

🚨 New labs just dropped! 3 new Python Code Review labs are now live on PentesterLab 🐍 Learn to spot subtle bugs and insecure patterns by reading real Python code. 🎯 pentesterlab.com/badges/python-code-review #Python #AppSec #CodeReview #PentesterLab

Really awesome preso from @snyff.pentesterlab.com @pentesterlab.com over at BSides Perth. Jam packed with patterns, approaches, tips and tricks to level up finding bugs in code. #bsides #bsidesperth

The past few weeks have been quiet, but we’re back! 🛠️ deepwiki.com 🛠️ github.com/AsyncFuncAI/... 🪲 blog.trailofbits.com/2025/04/23/h... 🛠️ github.com/quarkslab/pr... 🛡️ hdm.io/decks/Charti...

Your face when you realize your next security code review is on a Clojure codebase...

Articles worth reading discovered last week: 🪲 labs.watchtowr.com/xss-to-rce-b... 🧩 gist.github.com/Panya/990b45... #PentesterLabWeekly

Two great pieces of content for this week: 🪲 www.wiz.io/blog/ingress... 🪲 zhero-web-sec.github.io/research-and... #PentesterLabWeekly

‼️ blog.doyensec.com/2025/03/18/e... 📨 workos.com/blog/samlstorm 🛤️ projectdiscovery.io/blog/discour... ☑️ labs.watchtowr.com/by-executive... ❤️ tmpout.sh/4/ 🗼 labs.watchtowr.com/bypassing-au...

 Get our weekly news direct to your mailbox: pentesterlab.substack.com

If people spent as much time actually learning hacking as they do optimizing how to learn hacking, they’d be a lot better at it. Just start. Break things. Learn. Repeat.

We just released 3 new labs in our Golang Code Review Badge: pentesterlab.com/badges/golan... #golang

What a week! SAML&Ruby, PHP&XXE and so much more! 📨 github.blog/security/sig... 🧑🏻‍💻 seeinglogic.com/posts/visual... 🤯 swarm.ptsecurity.com/impossible-x... 😻 scrapco.de/blog/analysi... More details in our blog: pentesterlab.com/blog/researc... #PentesterLabWeekly

Articles worth reading discovered last week: 💎 www.elttam.com/blog/rails-s... ﹟ afine.com/understandin... 🪲 slcyber.io/blog/sitecor... For more details, check out our blog: pentesterlab.com/blog/researc...

Want to prove your API hacking skills? Earn the PentesterLab API badge! Hands-on labs designed to test and improve your ability to find and exploit API vulnerabilities. https://pentesterlab.com/badges/api

AI-generated code is reshaping secure code review—fewer trivial bugs, but more hidden threats. Read more in our new blog post: pentesterlab.com/blog/secure-... What do you think?