Dominique Righetto

Six consuming tags. One Safari trick: <select>. Bypass <noframes>, <xmp>, <noembed>, <style>, <title> and <noscript>. We've added all six vectors to our XSS cheat sheet: portswigger.net/web-security...

X.js : un benchmark vivant pour tester les vulnérabilités de sécurité dans Node.js Il rassemble 1 159 exploits validés, 4 type de faille sur 965 packages 👉 arxiv.org/abs/2610.1...

If you own a domain and serve a JS for your customers and you close the app, you still have to pay for the domain forever. Otherwise someone will buy it and start serving malicious JS. The newest case: ecomtrack-io. Existed for years, reregistered in September, now serves malware :-(

Anthropic found the origin of the NIST elliptic curve seeds: they were generated with drand48()! No one was seriously worried, but this should put some FUD to rest, completing the NIST ECC rehabilitation arc… just in time to be retired in favor of PQ. Also, we raised $36 Ki for ISRG. Yay!

🔐 Keycloak Extension for LuxTrust Orely Portal: github.com/kubsys-io/ke... #crypto #authentication #luxtrust #keycloak

We released a new version of #OWASP #Wrongsecrets ! With devcontainer and AI related challenges. Try it out at www.wrongsecrets.com and give the repo a ⭐️ if you like it!

If you want to see how to compromise an account from a paste and steal passwords in CSS and much more check out my paper "CSS: the bomb inside your inbox" 👇 portswigger.net/research/css...

🏖️🐻 Les logiciels libres de l'été, jour 35 Typer : une bibliothèque Open Source pour créer des applications en CLI que les utilisateurs adoreront utiliser et que les développeurs prendront plaisir à concevoir. Elle repose sur les hints de type de Python.

The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised. blog.pypi.org/posts/2026-0... #python #security #supplychain #pypi

blog.elcomsoft.com/2026/07/an-a... an interesting point of view on the OpenAI/Hugging Face incident

📡 OWASP Secure Headers Project - update: 1) We added info about the header "Integrity-Policy". 2) We defined the rules about GenIA usage. 3) We also developed a AI agent to help us (beta). 📖 github.com/OWASP/www-pr... 🤖 github.com/righettod/os... #appsec #appsecurity #owasp_shp

Voxxed Days Luxembourg 2026 talks are now online for you to enjoy 😀 ! luxembourg.voxxeddays.com/en/#videos ---- Les présentations de Voxxed Days Luxembourg 2026 sont maintenant en ligne et prêtes à déguster! 😀 luxembourg.voxxeddays.com/en/#videos

Assessments of threats can be seen from different perspectives. Developers may come across privacy impact assessments (PIAs), where threats to users' data and the impact on those users are paramount. PIAs may additionally examine harms to organisations, third parties and wider society. (1/6) #games

Next week, at VOXXED Days Luxembourg @lu.voxxeddays.com , I will present a version of the "Die & Retry" concept applied to the file upload feature, specifically for cases where PDF files are accepted 😉 m.devoxx.com/events/voxxe... #appsec #voxxed_lu

I needed code snippets for presentations. I was worried about pasting code snippets into untrusted sites. So I just wrote my own using AI. You can trust I won't be tracking your code. It's very customisable and the default is for presentations. hackvertor.co.uk/snippet

New badge: JavaScript Sandbox Escape! The first 4 labs are live. If you ship anything that evaluates untrusted or model-generated JavaScript, this badge is for you: pentesterlab.com/badges/javas...

We've launched a new free Web Security Academy topic on exploiting AI-powered security scanners! Learn how to use indirect prompt injection to steal data, cause damage & trigger exploit chains! Dive in here: portswigger.net/web-security...

With the new version of git, Welcome to the new "git history" command! 🎉 Rewording and split commits will be finally easier than before. 💪 github.blog/open-source/...

In collaboration with a couple of other leaders in the industry we are releasing securitytitles.com - It's an attempt to provide transparency about role levels, expectations and (just for the US market currently, salary ranges). For leaders writing JDs and candidates alike.

🎉 After a few years of refinement and close to 1 >> 9 commits, I'm pleased to announce the v1 release of my CORS middleware library for Go. Let me know whether it patches things up between you and CORS! github.com/jub0bs/cors #golang #CORS

Everyone is panicking about AI-generated zero days like it's an attacker story. It's not. Defenders can use the best models against their own code right now. Your progress compounds. Attackers' job gets harder. pentesterlab.com/blog/defende...

The Cornucopia of Gamified Threat Modeling At the OWASP Cornucopia project, we are done with updating the cards and help pages for the Website App Edition v3.0! dev.to/owasp/the-co... #appsec #cybersecurity #gamedev #security

heads up: FreeBSD forums hacked. Be caeeful with your email or DMs coming from FreeBSD forum or freebsd{.}org for some time now. https:// forums {.} freebsd {.} org/

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟯, 𝟮𝟬𝟮𝟲 Only one entry but definitely worth reading! ☁️ 𝗥𝗲𝗺𝗼𝘁𝗲 𝗖𝗼𝗺𝗺𝗮𝗻𝗱 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 𝗶𝗻 𝗚𝗼𝗼𝗴𝗹𝗲 𝗖𝗹𝗼𝘂𝗱 𝘄𝗶𝘁𝗵 𝗦𝗶𝗻𝗴𝗹𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗗𝗲𝗹𝗲𝘁𝗶𝗼𝗻 This one is a real tour de force: flatt.tech/research/pos....

Dear contributors to Voxxed Days Luxembourg's renewed success: the call for your papers, supposedly closed tonight wil be extended by 2 weeks to accomodate latecomers. A small reminder: 15 min. lunch talks are often under-filled, to test your speaker abilities, this is a perfect opportunity!