Carl Sampson

Sr. Security Researcher

[Clint Gibler @clintgibler]

🛠️ 𝐀𝐧𝐭𝐢𝐒𝐒𝐑𝐅
New secure-by-default library by @msftsecurity that prevents SSRF attacks.

Currently supports .NET and Node.js.

[Carl Sampson @chs]

The original "Showstopper!: The breakneck race to create Windows NT and the next generation at Microsoft " from 1994 was one of those books that fundamentally changed how I think about software development.

Reading about Dave Cutler's team building Windows NT from the ground up — the engineering culture, the technical decisions under pressure, the relentless focus on architecture — that influenced how I approach development and security.

When I first read it, I was earlier in my security journey. While the book wasn't specifically about security, seeing how they thought about system design from the ground up, the importance of getting the foundation right, that was a lightbulb moment.

This new edition reminds us that great software comes from great engineering culture and disciplined architecture decisions. In security, we talk a lot about "shifting left," but really we're talking about the same thing - getting the fundamentals right from the start.

What book fundamentally changed how you approach your craft?

#ApplicationSecurity #SoftwareEngineering #BookRecommendation #Engineering

[appsec.fyi @appsecfyi]

241 new https://t.co/I23uEdASpJ resources — SSRF (+12), AI (+10), API Security (+10), +22 more. https://t.co/7nFUjKMzag

[appsec.fyi @appsecfyi]

Async IO in Python: A Complete Walkthrough – Real Python

The content titled "Async IO in Python: A Complete Walkthrough" on Real Python likely provides a comprehensive guide on asyn…

https://t.co/4guVsTVZ0A #appsec #Python

[Carl Sampson @chs]

I've been building the iOS companion to https://t.co/sbPJaXAqjw — bringing those 3,000+ curated application security resources to your phone.

It's done!

Mobile-first features:
• Offline access to all articles and tools
• Interactive topic explorer with 75+ connections
• Built-in security glossary (48 terms)
• Browse by 25+ topics (XSS, SQLi, SSRF, IDOR, RCE, etc.)
• Background sync for new content

Grab it here - https://t.co/qpDSRUTPpu

[Carl Sampson @chs]

I've been building https://t.co/ecDm9BIyZ7 — a free curated library of application security resources.

2,600+ articles, tools, and writeups across 22 topics (XSS, SQLi, SSRF, IDOR, RCE, and more).

Just added search + 6 new topics. Submissions welcome.

https://t.co/MNWpwG8dBb

[Carl Sampson @chs]

I built csp-toolkit to parse and analyze Content Security Policy headers at scale. 21 checks, 79 bypass domains, full CLI + #Python API.

pip install csp-toolkit

Read more at - https://t.co/VmnjzMHzsZ

#infosec #bugbounty #appsec #opensourcesecurity #csp

[Carl Sampson @chs]

New post: Use-After-Free vulnerabilities — what they are, how they're exploited, and how to find them with ASan, libFuzzer, and CodeQL. Includes real CVEs from Chrome and the Linux kernel.

https://t.co/DPwJWou1PB

#appsec #security #memorysafety

[Carl Sampson @chs]

New post: CVE-2026-27696 — SSRF in https://t.co/PFlHAQFAYI via URL validation bypass. Default installs have no auth, and the server will happily fetch your AWS metadata endpoint. Root cause, attack scenario, and the TOCTOU problem most URL validators miss.

https://t.co/7dINtUCOMz

[Cam @SecretlyHidden1]

I met @wtm_offensi years ago and so glad to see him getting a spotlight blog post. He’s a super talented researcher and overall great person to have a convo with. I highly suggest giving the blogpost a read!

[Microsoft Security Response Center @msftsecresponse]

“You don’t pick the bugs. The bugs pick you.”

Meet Wouter (@wtm_offensi), Microsoft MVR and Zero Day Quest 2026 qualifier, and read his security research journey: https://t.co/f7jIhnNVXQ

[JS0N Haddix @Jhaddix]

Day FOUR of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

5th Giveaway = FOUR seats to our ONE OF A KIND course on using AI to scale you as a Red, Blue, or Purple Teamer:

!! Red Blue Purple AI !!

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21! Syllabus link below 👇

[JS0N Haddix @Jhaddix]

Day TWO of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

3rd Giveaway = FOUR seats to our new course by @the_IDORminator "Zero to [BAC] Hero" !

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21! Syllabus link below 👇

[Phillip Wylie @PhillipWylie]

To help celebrate @arcanuminfosec Information Security's two-year anniversary, @Jhaddix gave me 5 codes good for any Arcanum course to give away!

Winners will be announced on 1/22.

👍 1 Like = 1 Entry!

♻️ 1 Share = 2 Entries!

[Carl Sampson @chs]

Just finished up a great first day at #AmericaFest!

[Carl Sampson @chs]

Any chance of getting a picture with you at AmericaFest, @JesseBWatters? It’s my wife’s birthday this weekend and she chose for us all to go to Phoenix for her birthday! Would be a great birthday present. :)

[Carl Sampson @chs]

@JesseBWatters - my wife and I are huge fans. Any chance she can get a picture at AmericaFest? She turns the big 5-0 on Sunday!

[Carl Sampson @chs]

https://t.co/2r08qMgTNO