As an engineer, I ❤️ clever engineering. Ruby on Rails relies on signed sessions (AES GCM). They are secure, but there is a catch: you cannot invalidate them early. You have to wait for expiry. Workarounds exist, like caching sessions you want to kill, but nothing universal.

Two weeks of recording. My voice barely survived 😅 Both on-demand courses are now fully recorded: 🔎 Web Security Code Review 🐹 Secure Coding for Go Developers, beyond the OWASP Top 10 Launch discounts: pentesterlab.com/training/

When you discover the only thing your $500k security appliance was protecting was the vendor's quarterly earnings.

Claude be like: "Okay, we didn’t test what you asked us to test, but we still found 5 zero-days."

now that the KVM escape details are out (pwn.ai/blog/pwnescape)… if you’re wondering how i managed to rediscover it in under 2 hours after seeing the vercel bounty screenshot: i gave openai’s gpt-5.6-cyber (daybreak red) access to a devbox to experiment and explore different directions for 1.5 hours. then i spotted that the word after “guest-controlled” in the screenshot wasn’t properly redacted. those 3 dots gave away “virtio”. might seem like a small hint, but i passed it to my agent, and it got excited and found the vulnerability in 30 minutes. :)) opsec lesson right there.

frustrating outcome from some BB programs recently. --> I report 20 vulnerabilities --> find out 19 of them got auto closed because of a "limit" and only 1 stays open. the 19 includes RCE, SQLi, SSTI and other criticals --> I have to beg them to check the auto closed reports --> one month later they respond saying my exploits don't work anymore ( obviously?) --> after checking, they confirm all were genuine findings but they can't honor the reports then.. proceed and "encourage" me to send more vulns

Put some Spark in your relationship. 💍

Pitching VCs that you're starting an AI pentest startup...

Definitely worth a read 🔥 you won't regret it and you will learn lots. Great work Louis 💪

Your reminder to use path APIs when comparing paths. "/root".startswith("/roo") is true. That doesn't make /root a subdirectory of /roo. Java has the same trap: String.startsWith() and Path.startsWith() mean different things. github.com/snapspecter/mitmp…

There’s still enormous value in understanding how vulnerabilities actually work. That kind of knowledge never gets old. In fact, it’s probably becoming even more valuable. Great work, @PentesterLab, on putting all of this knowledge together.

To understand the future of open source software, it’s important to look at the XZ Utils backdoor attack. Imagine the potential value of such a vulnerability existing. Imagine the time and effort involved in getting it into place. Now imagine you wanted to put as many of those vulnerabilities in as many software programs as possible. How would you do it before AI agents existed? How would you do it now?

This is peak hackbot

Turns out, the AD in ADHD doesn’t stand for Active Directory.

AppSec ratio: 1 AppSec engineer for 50 devs? Give them 50x the token allowance. That person is supposed to help secure what all those developers are building. They should be able to burn tokens on code review, research, testing... Reverse the AppSec ratio. Use it as allowance!

"clean up all of your testing artifact" falls into a common problem of not knowing how your tools actually work