bubu

2026 has arrived. I’m exploring job opportunities and projects. Feel free to reach out.

Forgot to share this here, I wrote an analysis of the Plesk CVE-2025-6630 vulnerability. albertofdr.github.io/post/cve-202...

The Annual @portswiggerres.bsky.social Web Hacking Techniques Top 10 is now open for voting. If you believe my research “Permission Hijacking at Scale” adds value to the community, I’d be thankful for your vote. portswigger.net/polls/top-10...

pagedout.institute ← we've just released Paged Out! zine Issue #7 pagedout.institute/download/Pag... ← direct link lulu.com/search?page=... ← prints for zine collectors pagedout.institute/download/Pag... ← issue wallpaper Enjoy! Please please please share to spread the news - thank you!

So: the matrix.org database secondary lost its FS due to a RAID failure earlier today (11:17 UTC). Then, we lost the primary at 17:26. We're trying to restore the primary DB FS (which could be fastish), while also doing a point-in-time backup restore from last night (which takes >10h).

Excited to share that I’ll be speaking at #DefCampRO in November. See you there! 🇷🇴

Blink: Intent to Ship: Escape "<" and ">" in attributes on serialization

That's me!

Blink: Intent to Deprecate and Remove: Remove auto-detection of ISO-2022-JP charset in HTML

Hope Bluesky adds bookmarks soon. I can't wait to have hundred of bookmarks I’ll never read, while lying to myself that I will.

I posted a blog about how browser permissions work. albertofdr.github.io/web-security...

Handling Cookies is a Minefield: Inconsistencies in the HTTP cookie specification and its implementations have caused a situation where countless websites (including Facebook, Netflix, Okta, WhatsApp, Apple, etc.) are one small mistake away from locking their users out. grayduck.mn/2024/11/21/h...

If you missed it, my #DEFCON talk "Exploiting the Unexploitable: Insights from the Kibana Bug Bounty" is now live on YouTube! youtu.be/H-bhmSwnRdY

🚨 Introducing the 2024 Web Almanac, our annual "state of the web" report! 🔖 almanac.httparchive.org/en/2024/ 21 chapters (11 publishing today, the rest to follow) 65 contributors for today's chapters (more to follow) 17M websites analyzed 83 TB of data processed 628 queries written