Gareth Heyes

garethheyes.co.uk

20 October 2026 04:35

Six consuming tags. One Safari trick: <select>. Bypass <noframes>, <xmp>, <noembed>, <style>, <title> and <noscript>. We've added all six vectors to our XSS cheat sheet: portswigger.net/web-security...

Bearstech

bearstech.com

20 October 2026 04:34

X.js : un benchmark vivant pour tester les vulnérabilités de sécurité dans Node.js Il rassemble 1 159 exploits validés, 4 type de faille sur 965 packages 👉 arxiv.org/abs/2610.1...

Michal Špaček

spazef0rze.bsky.social

20 October 2026 04:32

If you own a domain and serve a JS for your customers and you close the app, you still have to pay for the domain forever. Otherwise someone will buy it and start serving malicious JS. The newest case: ecomtrack-io. Existed for years, reregistered in September, now serves malware :-(

Filippo Valsorda

filippo.abyssdomain.expert

17 October 2026 12:44

Anthropic found the origin of the NIST elliptic curve seeds: they were generated with drand48()! No one was seriously worried, but this should put some FUD to rest, completing the NIST ECC rehabilitation arc… just in time to be retired in favor of PQ. Also, we raised $36 Ki for ISRG. Yay!

Jeroen

commjoenie.bsky.social

23 September 2026 04:39

We released a new version of #OWASP #Wrongsecrets ! With devcontainer and AI related challenges. Try it out at www.wrongsecrets.com and give the repo a ⭐️ if you like it!