The Daily Swig

Web security news and views. The latest on bug bounty programs, technical research, hacking tools, and more. DMs open for tips.

[The Daily Swig @DailySwig]

We’re going teetotal: PortSwigger announces the closure of The Daily Swig

https://t.co/OwB6QOn966

[The Daily Swig @DailySwig]

This month’s #BugBountyRadar: Fresh targets from Grindr and Miro, infosec drama with XSS Hunter’s new host, and Belgium rolls out the red carpet for ethical hackers

https://t.co/9zOiONeuGu

[The Daily Swig @DailySwig]

Attackers could have created counterfeit driving licenses by exploiting a vulnerability – now patched – in the website of India’s road transport ministry (credit @_RobinJustin_)

https://t.co/VVTsg9KXxL

[The Daily Swig @DailySwig]

Password managers part II: The Daily Swig looks at enterprise-grade tech capable of managing login credentials, encryption keys, API tokens and more

https://t.co/tp0ZpIZoYd

[The Daily Swig @DailySwig]

Chromium bug allowed SameSite cookie bypass on Android devices

https://t.co/5ImkkbLRie

[The Daily Swig @DailySwig]

‘Standard web app security tests result in false negatives for web APIs’ – @hAPI_hacker on the need for bespoke defenses against increasingly popular attacks https://t.co/QjA3lu6E9u

[The Daily Swig @DailySwig]

Deserialized web security roundup: Twitter 2FA backlash, GoDaddy attack campaign, and XSS Hunter adds e2e encryption

https://t.co/GEVvFMW2OI

[The Daily Swig @DailySwig]

The US National Institute of Standards and Technology is planning a major reform of its Cybersecurity Framework, an authoritative guideline on managing cybersecurity risk

https://t.co/BgRfbgCBZf

[The Daily Swig @DailySwig]

Maintainers of new XSS Hunter fork add end-to-end encryption following backlash over privacy fears https://t.co/OOryhKH1Hq

[The Daily Swig @DailySwig]

A flaw in ClamAV anti-malware software has resulted in a vulnerability in Cisco security products

https://t.co/W6ETzas4FO

[The Daily Swig @DailySwig]

Weaknesses in the CVSS system have been highlighted through new research, with existing metrics blamed for 'overhyping' vulnerabilities

https://t.co/T2xhsXTAUe

[The Daily Swig @DailySwig]

API security expert Corey J Ball (@hAPI_hacker) on how to ‘arm the testers, and help prevent that next API-related data breach’

https://t.co/QjA3lu66jW

[The Daily Swig @DailySwig]

Belgium will protect ethical hackers under a nationwide safe harbor framework announced this week https://t.co/Ya461qJak9

[The Daily Swig @DailySwig]

A HTTP request smuggling bug has been patched in HAProxy

https://t.co/Gl0ZFdJG7M

[The Daily Swig @DailySwig]

Belgium launches Europe’s first nationwide safe harbor for ethical hackers

https://t.co/Ya461qJak9

[The Daily Swig @DailySwig]

Although Apache Kafka software has not transformed into a giant insect, it has spawned a serious security bug

https://t.co/22dc8sPX1V

[The Daily Swig @DailySwig]

Part one of our two-part series looks at the security pros and cons of consumer-focused password managers and what they can offer users

https://t.co/slK2RX5gZp

[The Daily Swig @DailySwig]

@Sisi_Bori @PortSwigger We will be announcing a new way to subscribe this week – keep an eye on our Twitter for more information!

[The Daily Swig @DailySwig]

Research into chaining OAuth flaws tops annual @PortSwigger web hacking list for 2022 (kudos @fransrosen)

https://t.co/WdRgNONH84

[The Daily Swig @DailySwig]

Deserialized web security roundup: KeePass dismisses ‘vulnerability’ report, OpenSSL gets patched, and Reddit admits phishing hack

https://t.co/nXRsGCQu38