Learn how AI tools can support security researchers in investigating vulnerabilities and designing security checks to detect them.

Learn about common security issues in AI-generated software, based on an analysis of over 20,000 vibe-coded web apps.

Learn how attackers can exploit LLM tool usage and MCP servers, why this expands the attack surface, and how automated DAST scanning strengthens LLM security in web applications.

Teaching LLMs how to XSS An introduction to fine-tuning and reinforcement learning (using your own GPU)

The Assistant Prefill feature available in many LLMs can open up models to jailbreaking, including the possibility of persistent prefills to bypass LLM safety alignments.

My talk explores the trajectory of iOS spyware from the initial discovery of Pegasus in 2016 to the latest cases in 2024. The talk will ...

OpenAI o3 scores 75.7% on ARC-AGI public leaderboard.

Discover amazing ML apps made by the community

There has been an increasing amount of fear, uncertainty and doubt (FUD) regarding AI Scaling laws. A cavalcade of part-time AI industry prognosticators have latched on to any bearish narrative the…

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...

this article introduces two methods for leveraging Logback configuration to achieve Remote Code Execution (RCE) in Spring Boot applications. These techniques are effective on the latest version of Spr...

Translate any JavaScript code to foreign writing systems. Created by Martin Kleppe aka @aemkei.

This post discusses how I found and responsibly disclosed a Cross Site Scripting in DeepSeek and it was possible to trigger it via Prompt Injection to achieve complete account takeover. The issue was ...

We build and maintain an open repository of web crawl data that can be accessed and analyzed by anyone.

Brainstorm is a new, smarter web fuzzing tool that combines local LLM models and ffuf to optimize directory and file discovery

A talk about recent high-profile issues related to the SSH ecosystem.

based on findings from a live hacking event

Web Application Firewalls (WAFs) help to protect web applications by monitoring, filtering, and blocking HTTP traffic to and from a web service. However, WAFs are too often relied upon as...

Wireless and firmware hacking, PhD life, Technology

YouTube video by BSidesCHS

As we shift our focus from benchmarks to real world applications, we will be sharing some of the most interesting vulnerabilities XBOW has found in real-world, open-source targets. The first of these ...

This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports - arkadiyt/bounty-targets-data

Recraft's image generation service uses a unique architecture combining an LLM (Claude) with a diffusion model. Learn what led to the discovery that carefully crafted prompts could expose the system's...

Learn how to analyze WordPress hack access logs using Google's NotebookLM, featuring a real-world case study of detecting and investigating a CVE-2023-6961 exploit in the WP Meta SEO plugin through in...