“Simplicity is a great virtue, but it requires hard work to achieve and education to appreciate. And to make matters worse, complexity sells better.” — Edsger Dijkstra
What I’ve always found amazing about CTFs is that "flag is flag". Whether you found an unintentional solve or pwned the browser with n-day for a XSS challenge, it didn't matter.
I totally get the frustration of AI, but there is no solution other than accepting the change.
Probably not. Prompting an LLM with natural language is inherently lossy and ambiguous. Up to this point, programming has always been deterministic: Your code does what you say it should do otherwise, it’s a bug. Coding agents break that contract. https://t.co/gqsBV0nQBa
It's so cool to see so many people participate in our #WCUS WordPress CTF. @marcS0H from @jetpack is currently leading the competition! 😎 You can see the live scoreboard here: https://t.co/rHwax8rPJQ
Our researchers found a Pre-Auth Object Injection vulnerability in the SEOPress plugin (300k+ active installs). It was fixed in the recent 7.9 update. Make sure to update now! #wordpress#security
https://t.co/Mor1Qwvc0V
Our researchers found a Pre-Auth Object Injection vulnerability in the SEOPress plugin (300k+ active installs). It was fixed in the recent 7.9 update. Make sure to update now! #wordpress#security
https://t.co/Mor1Qwvc0V
The first part of the blog series: #Iconv, set the charset to RCE. We'll use #PHP filters and #CVE-2024-2961 to get a very stable code execution exploit from a file read primitive. #cnext
🔥Multiple XSS vulnerabilities in popular CMS Joomla! (CVE-2024-21726) 🔥
PHP bug could be used to bypass sanitization - We just disclosed the technical details behind the recent Joomla vulnerability:
https://t.co/9JVMjj5FO9
Automattic is expanding the Jetpack and WPScan Security Research team, if you like to break PHP code and investigate malware fill out the interest form here: https://t.co/WUqX2IyJNe
#hiring#wordpress#securityresearch#remotejobs
Balada Injector: analysis of the initial and secondary infections.
Domains: *.specialcraftbox[.]com and *.greenfastline[.]com (more in the post)
Vulnerable plugin: Popup Builder.
Thanks @marcs0h for the help with understanding the vuln
Our researchers found a Pre-Auth Stored XSS vulnerability in the WP Go Maps plugin (formerly known as WP Google Maps, 400k+ active installs). It was fixed in the recent 9.0.28 update. Make sure to update now!
#wordpress#security
https://t.co/m0IWVsc7vs
Our researchers found a Pre-Auth Stored XSS vulnerability in the Popup Builder plugin (200k+ active installs). It was fixed in the recent 4.2.3 update. Make sure to update now!
#wordpress#security
https://t.co/h9O5MSOHXP
Expecting to struggle finding a gadget chain in WordPress Core during an assessment when devs suddenly decided to make it easy : https://t.co/gJhHoktLtD
Our researchers found a serious SQL Injection vulnerability in the WP Fastest Cache plugin. It was fixed in the recent 1.2.2 update. Make sure to update now!
https://t.co/Dk6m1ciEGd
#wordpress#security