iiinova — where your digital self keeps evolving

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 03/10/2026

"SQLDoom ports the original 1993 Doom's game logic and renderer to SQL and runs it inside CedarDB." GitHub: github.com/cedardb/sqldoom

001 1

Reposted by Cure53🔓

abadidea @0xabad1dea.infosec.exchange.ap.brid.gy · 24/09/2026

Postmortem of a little community hobby wiki struggling to survive an extinction-event-tier DDOS purely because they banned one guy for using Claude on the wiki blog.xkeeper.net/the-cutting-room-f…

260105 105

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 20/09/2026

RE: infosec.exchange/@lcamtuf/117300984… Our entire team has their lips mutilated and here were are, being made fun of...

infosec.exchange

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 19/09/2026

Phase 3 cannot be talked about yet, thanks for understanding.

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 19/09/2026

Phase 1 "project babyfication" has completed successfully. Phase 2 "vampire romance" shall now commence.

100 1

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 18/09/2026

@luxaritas.com Hmm, not sure, this mostly covers HTML sinks, but not completely impossible with DOMPurify hooks... Maybe doable, not sure though how reliable.

110 1

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 14/09/2026

Imagine a Bitcoin walletswritten in pure CSS, who wants to invest??? 🚀 groups.google.com/a/mozilla.org/g/d…

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 11/09/2026

In recognition of bravery, patriotism and an unwavering love of freedom, we have decided to rename Microsoft Teams as Microsoft America. Please update your SBOM and software directories; this change is immediate and permanent. Thank you for your attention to this matter. 🦅

001 1

Reposted by Cure53🔓

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 10/09/2026

Open Call for Nominations: European Open Source Awards 2027 Please consider taking a minute and tell us who we should recognize and honor this time around! We need to know about the heroes to be able to celebrate them. awards.europeanopensource.academy/n…

159 9

Reposted by Cure53🔓

Manuel 'HonkHase' Atug @honkhase.chaos.social.ap.brid.gy · 10/09/2026

Der bundesweite Warntag war heite um 11 Uhr und Entwarnung um 11:45 Uhr. Habt ihr die Meldung auf dem Handy erhalten? Habt ihr die Sirenen gehört? Nur durch eurer Feedback kann es verbessert werden! Online-Umfrage zum Bundesweiten Warntag 2026 vom @bbk www.warntag-umfrage.de

2120 20

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 09/09/2026

A machine pretending to be a human writes a letter to a human, who really doesn't want to read it and sends it to another machine pretending to be a human, so it can write the human-like reponse to the other machine pretending to be human, on behalf of the actual human. Seems a bit inefficient […]

infosec.exchange

Original post on infosec.exchange

010 1

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 09/09/2026

Might create talk slides about the top ten most absurd agent interactions... Favorite so far was the agent agreeing to a meeting, then us waiting in the lobby, sending the client a reminder, and some guy entering the call being like "who are you, why am I here!!?"

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 09/09/2026

Are there more people in the penetration testing business who are flooded with emails from AI agents wanting to negotiate scope and purchase a penetration test? Over the past few weeks, we have received a lot of them - and I mean A LOT - each wilder than the last. Almost all of the emails are […]

infosec.exchange

Original post on infosec.exchange

102 2

Reposted by Cure53🔓

tante @tante.tldr.nettime.org.ap.brid.gy · 14/07/2026

A computer booting Windows 1.0 and DOOM emulated using just CSS (Original title: CSS-DOS — A computer made of CSS) css-dos.ahmedamer.co.uk

css-dos.ahmedamer.co.uk

CSS-DOS — A computer made of CSS

111 1

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 02/07/2026

CTFs hopefully being the primary usecase 🫠

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 01/07/2026

During July & August, we will continue to accept security bug reports for DOMPurify. If anything serious is found, we will patch it immediately and release an update. As always. We call this approach the 'summer of responsible OSS maintenance' and prefer it to ignoring security bugs and […]

infosec.exchange

Original post on infosec.exchange

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 28/06/2026

RE: mastodon.online/@mullvadnet/1168222… What a shitty response, shame on you. Coming here and talking about values? Really? Here are the values of the guy your co-whatever is funding, just for the record: en.wikipedia.org/wiki/Markus_Allard

mastodon.online

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 25/06/2026

@Isurandil ActiveXObject("Microsoft.XMLHTTP") from CSS deplyed via <img> ✅

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 25/06/2026

@Isurandil we're already vibe-coding an implementation, ActiveXObject tests all green, landing PR soon

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 25/06/2026

RE: mas.to/@patrickbrosset/116809815574… 🙏🏻 exciting new scripting abilities 🙏🏻 no more boring SOP 🙏🏻 CSS from <img> to style entire page 🙏🏻 big comeback for embedded Java Applets 🙏🏻 SVGZ and ActiveX while we're at it

mas.to

111 1

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 23/06/2026

We updated our public report repository and there is now lots of new material. Here you are, meanwhile 253 pentest reports, summary reports and papers: github.com/cure53/Publications/tree…

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 18/06/2026

Crazy to see that some folks still get paid their salary in money instead of LLM tokens. They gonna spend the money on tokens anyway, why waste time on legacy payment methods from yesteryear??

010 1

Reposted by Cure53🔓

Tom Stafford @tomstafford.mastodon.online.ap.brid.gy · 02/06/2026

Fedizens! Please send me your favourite meme which shows something important about the #Fediverse I'll go first:

Star wars meme. Empire soldier land to interrogate the retired general. "Mastodon? Really? Man of your talents?". He replies: "It's a peaceful life"

From: https://knowyourmeme.com/memes/its-a-peaceful-life

"It's a Peaceful Life, also known as Really? Man Of Your Talents?, is a reaction image and image macro meme format using a scene from the 2016 film Rogue One: A Star Wars Story in which the character Galen Erso (played by actor Mads Mikkelsen) tells Orson Krennic (Ben Mendelsohn), "It's a peaceful life," after Krennic expresses pitiful shock that Erso is a farmer"

3039212 212

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 16/06/2026

We proudly present — DOMPurify 4.0.0 — the first purely agentic sanitizer 🤖🧼✨ No more rules — no more regex — no more deterministic boredom — Only adaptive intelligence — autonomous decisions — AI-powered sanitation — and the future of XSS prevention — right here — right now 🚀 […]

infosec.exchange

Original post on infosec.exchange

001 1

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 16/06/2026

RE: cyberplace.social/@GossiTheDog/1167… We heard that Twitter/X too is critical for national security and folks outside the US should no longer be able to use it. Facebook as well, no? #securityfirst

cyberplace.social

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 15/06/2026

Future releases will no longer be able to ignore STML, <ssafe> and the so far quite unknown </lml>. Guess the cat is out of the bag now. This is technically a toot about cats 🐱

More slop, in DOMPurify context. The toot has the highlights.

010 1

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 12/06/2026

Small field update... in the past weeks we have seen. * 10+ requests for audits against vibe-coded crypto software & messenger * 1 request for an audit against vibe-coded medical software * 1 request to only use LLMs for audits as there is allegedly too much code for any human to review * […]

infosec.exchange

Original post on infosec.exchange

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 12/06/2026

DOMPurify 3.4.10 is out, mostly refactoring, should be a bit faster, and a bit more robust. Lots of new tests, documentation etc. Long time to LLM-reported bypasses, maybe things are slowly calming down and we managed to address all exotic config options leading to foot-guns? 🤞🍀 😅 […]

infosec.exchange

Original post on infosec.exchange

010 1

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 05/06/2026

The great thing about LLMs is that they make it possible for anyone to create a crypto messenger. All you need is passion and a few tokens. Mega-corporations like Signal can no longer gatekeep and monopolise using their powers - it's finally power to the people!

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 27/05/2026

RE: infosec.exchange/@timb_machine/1166… This. It's is mostly where our last three to four weeks have spent with for DOMPurify...

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 27/05/2026

DOMPurify 3.4.7 is out with again several in-depth improvements. If you are using the IN_PLACE config option in production, you might want to go for this one soonish. This is where folks seem to use their Claude tokens for at the moment 😅 github.com/cure53/DOMPurify/release…

github.com

Release DOMPurify 3.4.7 · cure53/DOMPurify

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker Removed a problem leading to permanent hook pollution, thanks @offset Refactored the test suite and expanded test c...

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 19/05/2026

You probably not gonna like this, yet somewhat might have anticipated... We are seeing a stark influx in requests to audit vibe-coded cryptography. So, vibe-crypto is a thing and will be one for a while. Do what now?

211 2

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 18/05/2026

Here's a brief overview of the timeline: Yesterday afternoon (CEST), DOMPurify 3.4.4 was released, which allowed the tag <selectedcontent> by default. At 4am CEST today, an email informing us about the bypass was sent by the finder. The <selectedcontent> tag is dangerous and cannot be […]

infosec.exchange

Original post on infosec.exchange

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 18/05/2026

🚨 DOMPurify 3.4.5 is out, fixing a bypass caused by the <selectedcontent> element, affecting Blink. 🚨 The bypass was reported this morning and a fix release was pushed immediately. github.com/cure53/DOMPurify/release… The DOMPurify 3.4.4 release has been deprecated, an […]

infosec.exchange

Original post on infosec.exchange

000 0

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 18/05/2026

Turns out, the <selectedcontent> element is dangerous.

001 1

Cure53🔓 @cure53.infosec.exchange.ap.brid.gy · 17/05/2026

@jerry Also, pwn2own with zero findings in Microsoft Internet Explorer for several years meanwhile (!). Time for our blue friend to take back the web, not sure why we even abandoned the king of browsers.

000 0