Do you want to end one or more processes at a time using a regular expression (regex) on your Linux, FreeBSD, macOS or Unix-like system? Try: pkill regex pkill -9 pattern The regex/pattern will match the process names or command lines that you see using ps/top/htop. Pretty useful for CLI users.

 Shai‑Halud : Supply Chain Attack qui cible des paquets npm sous les comptes CrowdStrike. Il télécharge et exécute des outils comme TruffleHog puis cherche des tokens, crée des workflows GitHub Actions non autorisés et exfiltre des données. 👉 socket.dev/blog/ongo...

🧑‍🎓 Learning of the day for me: During my technical survey, I found a GitHub project offering a POC for CVE-2025-54988. I therefore decided to add a new check for this attack vector to my code snippet project for validating PDF files. github.com/righettod/co... #appsec #appsecurity

You can configure it any way you want or need, but the extension comes with a bundled configuration files you can use out of the box. One of them disallows dangerous functions like var_dump() or put_env(), while another one blocks insecure functions like hash() with MD5 github.com/spaze/phpsta...

📡 OWASP Secure Headers Project: We added information about the response header "X-DNS-Prefetch-Control" based on technical tests we performed. #appsec #appsecurity #owasp_shp 📖 owasp.org/www-project-...

The AD CS security landscape keeps evolving, and so does our tooling. 🛠️ Valdemar Carøe drops info on Certify 2.0, including a suite of new capabilities and refined usability improvements. ghst.ly/45IrBxI

@nolimitsecu.bsky.social Hi, it is normal that the link to this episode led to a 404 ? www.nolimitsecu.fr/owasp-secure... Did I missed a migration? Thanks a lot for your help 😊

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

💡 Discovery of the week for me: While reviewing code on a .Net project (CSharp language), I noticed that SemGrep, with its set of community rules, was not effective on this technology. So I looked for a complement and found Microsoft's DevSkim tool...

🏖️🐻 Les Logiciels Libres de l'été, jour 46 D2 : Un outil de scripting Open Source pour générer vos diagrammes. (p)

Un tableau listant des alternatives gratuites et/ou Open Source aux applications Adobe.

📚 L'ANSSI publie un nouvel Essentiel relatif à la mise en œuvre sécurisée d’une infrastructure de gestion de #clés (IGC) hiérarchique gérant les certificats à usage interne à une entité. Découvrez les recommandations de l'ANSSI sur : 🔗 cyber.gouv.fr/publications...

Des améliorations du plugin DIMA pour détecter et sensibiliser sur les techniques de manipulation en ligne sont disponibles ! : m82-project.org/articles/dim...

Sécurité Open Source : Google annonce OSS Rebuild, un service qui reconstruit automatiquement les paquets Open Source (Python, JavaScript, Rust) et compare le résultat avec les artefacts publics. 👉 security.googleblog....

tldr-pages : propose des fiches d’aide communautaires pour les outils CLI, avec des exemples concrets et lisibles en complément des pages 'man' parfois un peu trop longues et techniques. 👉 le projet : github.com/tldr-pages/ 👉 En savoir plus : https://tldr.sh/

ICYMI: In Senior Security Consultant Douglas Berdeaux's latest blog he breaks down the best process for incorporating penetration testing into the Software Development Lifecycle 🔗 redsiege.com/sdlcpentesting #hacking #infosec #cybersecurity

🏖️🐻 Les Logiciels Libres de l'été, jour 36 : Gitleaks : un outil Open Source pour détecter et prévenir les secrets et infos sensibles dans les dépôts Git. Il scanne les commits, les branches et l'historique à la recherche de mdp, clés API, etc. Il peut être intégré dans votre CI/CD.

Analyzing Sharepoint Exploits (CVE-2025-53770, CVE-2025-53771) https://isc.sans.edu/diary/32138

🏖️🐻 Les Logiciels Libres de l'été, jour 33 : Lnav : visualisation de logs Open Source permettant de parcourir et d'analyser vos logs dans une interface conviviale en CLI.

It's been 0 days since git reflog saved my ass (and files) again. Instead of rebase this branch, I did reset this branch, losing my commits. `git reflog`, find out what happened (reset at {46} and {48} in the pic), then `git branch name id` (id ends with 67 at {50}, commits are back.

🏖️🐻 Les Logiciels Libres de l'été, jour 32 : Vulhub : un projet Open Source offrant des environnements vulnérables préconstruits basés sur Docker-Compose. Idéal pour tester et apprendre la gestion des vulnérabilités, chaque environnement inclut un guide d'installation et d'utilisation.

Now live on tools.honoki.net/smuggler.html Let me know what you think! ✨

🎉 Celebrating！ 🎉 (500+ new stars) 📦 C4illin / ConvertX ⭐ 3,928 (+657) 🗒 TypeScript 💾 Self-hosted online file converter. Supports 1000+ formats ⚙️

🔬 When I perform a secure code review, I want to inform the DevOps team of any external libraries used that are affected by a public vulnerability (CVE/GHSA). However, it is very common for the team to use an internal artifact repository (such as Nexus, Artifactory, etc.) ... #appsec #appsecurity

This is dropping ed375deea6f7407d2ff9dab1cb326473 (bazaar.abuse.ch/sample/c68e4...) credits Varun Sharma for the share on LinkedIn

Looks like the maintainer of a number of highly-popular npm packages was phished through npnjs[.]com, and his access used to publish malicious versions of their packages x.com/JounQin/stat... www.linkedin.com/feed/update/... github.com/prettier/esl...

IA : avec cette technique, les résumés d’e-mails de Gemini se transforment en phishing ! ino.to/IYjB2SE

🏖️🐻 Les Logiciels Libres de l'été, jour 22 : @languagetool_fr : un correcteur d’orthographe et de grammaire multilingue Open Source.

🔬 When I perform a secure code review, I also check whether the external components used are affected by public vulnerabilities (CVE). Recently, after a advice from my manager on this subject, I tried to go further and check whether the CVEs identified had a POC/Exploit. #appsec #appsecurity #cve

Yet another ZIP trick... hackarcana.com/article/yet-... + a hands on exercise if you want to try this yourself: hackarcana.com/article/yet-...

We break down DNS rebinding attacks in our latest blog post. Explore the topic further and see how it can be used to exploit vulnerabilities in the real-world. github.blog/security/app...

📦 google-gemini / cookbook ⭐ 13,617 (+42) 🗒 Jupyter Notebook Examples and guides for using the Gemini API

🧑‍🎓 Learning of the day for me: I discovered that it is possible to leverage the instruction "include" in a XSD schema to perform a SSRF when the schema is parsed by the schema factory. #appsec #appsecurity #java

The MCP spec has been updated to include security best practices • Confused deputy • Token passthrough • Session hijacking modelcontextprotocol.io/specificatio...

🏖️🐻 Les Logiciels Libres de l'été, jour 2 : OpenSign : une solution de signature électronique Open Source ! Une nouvelle alternative libre à DocuSign, qui rejoint Documenso comme option pour la signature électronique Open Source.

Very interesting blog post from a secure code review perspective. I discovered it thanks to @pentesterlab.com "Unexpected security footguns in Go's parsers" #go #appsec #appsecurity blog.trailofbits.com/2025/06/17/u...

New! #OWASP #Wrongsecrets big LCM release: github.com/OWASP/wrongs.... Try it out at www.wrongsecrets.com

The @lu.voxxeddays.com team has made once again amazing work, and the conference was wonderful as usual since its beginning in 2016 🥰 So many great talks, things learned and discovered as well as friends seen 💓 Thank you for organising this event in Luxembourg. This conference is my Disneyland 🤩

🎉 I've just released v0.7.0 of jub0bs/cors, my #CORS middleware library for #golang! 💀 Now that Private-Network Access (PNA) has been put on indefinite hold in favor of a new permission-based mechanism named "Local-Network Access", I've removed all support for PNA. github.com/jub0bs/cors

💡Learning of the week for me: When using a web application based on the SEAM framework, you can access the source code of the JSF page by replacing the ".seam" extension with ".xhtml". This works if access to xhtml files is not blocked. #appsec #appsecurity

📡 OWASP Secure Headers Project: We've reworked the section providing code snippets for configuring different web/application servers to leverage "LLM as a Service" providers. #appsec #appsecurity #owasp_shp 📖 owasp.org/www-project-...

Voxxed Days Luxembourg is proud to welcome Didier Barzin for the marvellous talk: "Mercator - Mapping the information system"! Be sure to check the details on the schedule app: mobile.devoxx.com/events/voxxe... and favourite if you‘d like to see it! ⭐

Another nice use case for Fetch Metadata headers (which we used for anti-CSRF in the last episode): server-side analytics. On the client-side, any rendered HTML is a browser pageview, but on the server-side how do you tell pageviews from API calls from resource loads? Sec-Fetch-Mode: navigate!

💡Finding of the day for me: I found the following GitHub repository to find out if there is a POC for a CVE. 🤝Many thanks to "Trickest, Inc." for this project. 🌍GitHub repository: github.com/trickest/cve 🐞Example for a CVE: github.com/trickest/cve... #appsec #appsecurity #cve

phptop : une Profileur de ressources de base PHP (CPU/mémoire), Open Source, sécurisé et utile pour les sites de production 👉 github.com/bearstech...

Metadata Editor : une application Open Source développée par la Banque mondiale conçue pour aider les data curators à documenter divers types de données selon des normes spécifiques. 👉 Le projet : worldbank.github.io/... 👉 En savoir plus : github.com/worldbank...

Blogged: Handling OpenID Connect error events in ASP.NET Core damienbod.com/2025/06/02/h... #aspnetcore #dotnet #identity #openidconnect #oauth #oidc #iam

Nerdlog : un visualiseur de logs distribué Open Source 👉 Le projet : github.com/dimonomid... 👉 En savoir plus : dmitryfrank.com/proj... Découvert grâce à Blaise GERVAIS et Laurent Biagiotti

Pour célébrer les 30 ans de Java au Voxxed Days Luxembourg @lu.voxxeddays.com , je revisite le « Hello world » en Java, de 35 manières différentes en utilisant différentes fonctionnalités introduites dans les JDK 1.0 à 24, allant de la version classique, à la génération dynamique de bytecode.