📡 OWASP Secure Headers Project: We have refactored the section on the browser’s "Local Network Access" feature. #appsec #appsecurity #owasp_shp 📖 owasp.org/www-project-...

In collaboration with a couple of other leaders in the industry we are releasing securitytitles.com - It's an attempt to provide transparency about role levels, expectations and (just for the US market currently, salary ranges). For leaders writing JDs and candidates alike.

🎉 After a few years of refinement and close to 1 >> 9 commits, I'm pleased to announce the v1 release of my CORS middleware library for Go. Let me know whether it patches things up between you and CORS! github.com/jub0bs/cors #golang #CORS

Everyone is panicking about AI-generated zero days like it's an attacker story. It's not. Defenders can use the best models against their own code right now. Your progress compounds. Attackers' job gets harder. pentesterlab.com/blog/defende...

The Cornucopia of Gamified Threat Modeling At the OWASP Cornucopia project, we are done with updating the cards and help pages for the Website App Edition v3.0! dev.to/owasp/the-co... #appsec #cybersecurity #gamedev #security

heads up: FreeBSD forums hacked. Be caeeful with your email or DMs coming from FreeBSD forum or freebsd{.}org for some time now. https:// forums {.} freebsd {.} org/

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟯, 𝟮𝟬𝟮𝟲 Only one entry but definitely worth reading! ☁️ 𝗥𝗲𝗺𝗼𝘁𝗲 𝗖𝗼𝗺𝗺𝗮𝗻𝗱 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 𝗶𝗻 𝗚𝗼𝗼𝗴𝗹𝗲 𝗖𝗹𝗼𝘂𝗱 𝘄𝗶𝘁𝗵 𝗦𝗶𝗻𝗴𝗹𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗗𝗲𝗹𝗲𝘁𝗶𝗼𝗻 This one is a real tour de force: flatt.tech/research/pos....

Dear contributors to Voxxed Days Luxembourg's renewed success: the call for your papers, supposedly closed tonight wil be extended by 2 weeks to accomodate latecomers. A small reminder: 15 min. lunch talks are often under-filled, to test your speaker abilities, this is a perfect opportunity!

🧑‍🎓 Learning of the day for me, once again thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation). #appsec #appsecurity

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟮, 𝟮𝟬𝟮𝟲 AI doing research, AI killing CTF 🤖 𝗧𝗲𝘀𝘁𝗶𝗻𝗴 𝗔𝗜 𝗳𝗼𝗿 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝟰 𝗔𝗽𝗽𝗿𝗼𝗮𝗰𝗵𝗲𝘀 & 𝗪𝗵𝗲𝗿𝗲 𝗜 𝗙𝗮𝗶𝗹𝗲𝗱 If you can only read one thing this week, make it this article: xclow3n.github.io/post/7.

Le CFP des 10 ans de VoxxedDays Luxembourg est toujours ouvert, ne trainez plus :) → voxxedlu2026.cfp.dev#/

🧑‍🎓 Learning of the day for me thanks to @pentesterlab.com (for the presentation of the behavior and the code review lab) and Claude (for the detailed explanation): #appsec #appsecurity

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟬, 𝟮𝟬𝟮𝟲 A great mix of content this week! 🔒 𝗜𝗿𝗼𝗻𝗖𝘂𝗿𝘁𝗮𝗶𝗻: 𝗔 𝗣𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗔𝗜 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗕𝘂𝗶𝗹𝘁 𝗦𝗲𝗰𝘂𝗿𝗲 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗚𝗿𝗼𝘂𝗻𝗱 𝗨𝗽 Niels Provos (from OpenBSD's systrace) is sharing a new tool to sandbox your AI assistant: www.provos.org/p/ironcurtai....

My first @metasploit-r7.bsky.social module is live! You can now exploit CVE-2026-1731 (BeyondTrust command injection) with the latest version 😎

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟵, 𝟮𝟬𝟮𝟲 Mostly AI... 💻 𝗕𝗿𝗼𝘄𝘀𝗲𝗿-𝗕𝗮𝘀𝗲𝗱 𝗣𝗼𝗿𝘁 𝗦𝗰𝗮𝗻𝗻𝗶𝗻𝗴 𝗶𝗻 𝘁𝗵𝗲 𝗔𝗴𝗲 𝗼𝗳 𝗟𝗡𝗔 Leveraging Local Network Access to create a port scanner! wiki.notveg.ninja/tools/lna-po....

I wrote about what happens when you rewrite mature software with agents. You rebuild the features. You don't rebuild the scars. vinext: one engineer, one week, $1,100 in tokens. Then plenty of vulnerabilities found within days. pentesterlab.com/blog/what-yo...

Zensical : un générateur de sites statiques qui permet de transformer rapidement une documentation Markdown en un site professionnel, personnalisable et multilingue. (Découvert via Mat V. ) 👉 Le projet : github.com/zensical/... 👉 En savoir plus : https://zensical.org/

6 new code review labs just dropped 🚀 +3 for JavaScript Code Review +3 for Python Code Review JS: pentesterlab.com/badges/javas... Python: pentesterlab.com/badges/pytho...

🧑‍🎓 As part of my homework on AI from an AppSec perspective, I have decided to gather all my content on GitHub so that I can share it in case anyone is interested. 📖 Cheat sheet, methodology and tools: github.com/righettod/to... 🔬 R&D: github.com/righettod/po... #appsec #appsecurity #ai

🔥 OWASP CRS is evolving! Introducing #CRSLang — a new YAML-based rule language replacing Seclang. Cleaner syntax, multi-engine support, bidirectional translation, and a lower barrier for new contributors. Check it out 👉 coreruleset.org/2026...#CRSLang#WAF #AppSec #OWASP #ModSecurity

Erratum, it's opened tonight February the 15th 😂 -------------- Erratum, c'est ouvert ce soir le 15 février 😂

Voxxed Days Luxembourg's CFP will be opened from tonight February the 17th at 11:30 PM to March the 29th at midnight.Luxembourg ---------------- L'appel aux orateurs de Voxxed Days sera ouvert à partir de ce soir, le 17 février à 23h30 jusqu'au 29 mars à minuit. --- voxxedlu2026.cfp.dev

OWASP Cornucopia just release v2.6.0 github.com/OWASP/cornuc... The new release comes with support for continuing the game session even if players can not continue the game when playing on copi.owasp.org #owasp #appsec #security #cornucopia

Added a small feature to cspbypass.com to warn the user if unsafe-inline is detected, in which case you typically don’t need to waste time hunting for 3rd-party whitelisted CSP bypasses and go straight to inline scripts / event handlers.

Sqldef : un outil CLI qui permet le "diffing" de deux schémas SQL et de générer automatiquement les instructions de migration nécessaires. 👉 sqldef.github.io/

MORE LABS IN OUR JAVASCRIPT CODE REVIEW BADGE: pentesterlab.com/badges/javas...

Important Clarification: Notepad++ Security Incident (Indicators of Compromise provided by our former hosting provider is included): notepad-plus-plus.org/news/clarifi...

🧑‍🎓 Learning of the day for me thanks to @pentesterlab.com and Claude. 🔬 For the regular expression "[A-z]": In a character class [X-Y], it matches all characters with ASCII codes from X to Y inclusive. So [A-z] means all ASCII characters from 65 (A) to 122 (z). #appsec #appsecurity

Notepad++ Hijacked by State-Sponsored Hackers Security Update - Resolution of Notepad++ Update Server Compromise notepad-plus-plus.org/news/hijacke...

🎉 I've just released v0.11.0 of jub0bs/cors, my CORS middleware library for Go! Bar any surprises, this will be the last minor release before v1. github.com/jub0bs/cors

📡 OWASP Secure Headers Project: The OWASP Foundation has decided to migrate its content to a new CMS. As a result, OSHP content is frozen for the duration of the migration. You can find more information and explanations in the discussion below. github.com/OWASP/www-pr... #owasp_shp

Love web & AI security research? Want to do it full time on-site with myself, Gareth Heyes & Zak Fedotkin? Join the PortSwigger Research team - we're hiring! apply.workable.com/portswigger/...

🔥 CVE-2026-23993: HarbourJwt JWT auth bypass via unknown alg. Not just alg=none: unsupported alg => empty signature, so forged token header.payload. passes. Write-up + fix: pentesterlab.com/blog/cve-202...

🧑‍🎓 Learning of the day for me: I discovered that browsers (at least Chromium) display an SVG image even if the specified content type is set to XML. The contained JS script is also executed. #appsec #appsecurity

📡 OWASP Secure Headers Project: We have added information and examples regarding the Trusted Types feature of the Content-Security-Policy header. 📖 owasp.org/www-project-... #appsec #appsecurity #owasp_shp

🔥 Hot Repo！ 🔥 (100+ new stars) 📦 C4illin / ConvertX ⭐ 13,699 (+159) 🗒 TypeScript 💾 Self-hosted online file converter. Supports 1000+ formats ⚙️

docker-android : une image Docker minimaliste permettant de faire tourner un émulateur Android avec KVM. 👉 github.com/HQarroum/...

Best news I've discovered today is that ripgrep is also available for Windows and you can install it with winget (winget install ripgrep). ripgrep is like the grep utility in Linux, but a bit faster, it also accepts grep's params github.com/burntsushi/r...

📚 Les guides de l’ANSSI sont sur #MesServicesCyber ! 🖥️ Alors que le site de l’ANSSI évolue, MesServicesCyber se transforme pour vous simplifier l’accès aux conseils et recommandations de l’ANSSI, et de ses partenaires. Rendez-vous sur : 🔗 messervices.cyber.gouv.fr/catalogue/?m...

📦 0xk1h0 / ChatGPT_DAN ⭐ 10,302 (+47) ChatGPT DAN, Jailbreaks prompt

Introducing Pathfinding.cloud, a library of privilege escalation paths in AWS securitylabs.datadoghq.com/articles/int... by @sethsec.bsky.social

🎄 Jour 16 du Calendrier de l'Avent des 🐻 Xan : un outil en ligne de commande Open Source, écrit en Rust au médialab de SciencesPo 🇫🇷, conçu pour manipuler de très gros fichiers CSV directement depuis le terminal. Un outil qui nous a été chaudement recommandé par d'admirables devs ❤️

The video recording of the session "Open Source AI and open washing" by OSI Board member Carlo Piana at Luxembourg's Open Source Conference is now available: https://peertube.opencloud.lu/w/jbPdfztnEcUqDjtn2E1EpQ

💡 Very interesting article about output escaping in an API context: #appsec #appsecurity #api treblle.com/blog/api-esc...

🧑‍🎓 Learning of the day for me thanks to: - @pentesterlab.com for the presentation of the behavior and the code review lab. - ChatGPT for the detailed explanation. #appsec #appsecurity #python

The BloodHound Query Library, launched by @martinsohn.dk & @joeydreijer.bsky.social, democratizes tradecraft with a shared, searchable ecosystem. With 180+ Cypher queries & counting, the library is an increasingly valuable tool for the BloodHound community! Browse ➡️ ghst.ly/bql_eoybsky

Meet AutoVader. It automates DOM Invader with Playwright Java and feeds results back into Burp. Faster client side bug hunting for everyone. 🚀 thespanner.co.uk/autovader

À la découverte du "SVG clickjacking" "I’ve discovered a new technique that turns classic clickjacking on its head and enables the creation of complex interactive clickjacking attacks, as well as multiple forms of data exfiltration." 👉 lyra.horse/blog/2025...

Welcome back to Slytherin! 🐍 We just released 3 new labs in our python^w Slytherin code review badge: real CVEs, sneaky bugs, and plenty of chances to sharpen your dark code arts.. Grab your wand here: pentesterlab.com/badges/pytho...

📡 OWASP Secure Headers Project: Over the years, we have compiled a collection of HTTP response headers that disclose technical information. We are continuing our research to find new ones on our own, but we have decided to ask our community for help in finding new ones. #appsec #owasp_shp