PentesterLab

Don’t just learn tools and payloads. Learn why vulnerabilities exist. Hands-on web hacking, security code review, and real-world CVE labs.

[PentesterLab @PentesterLab]

💥🐹 4 new Go Code Review Labs just dropped! 🐹💥

Read the code, peek at the diff, find the bug.

Sharpen your skills: https://t.co/0Y56bXk2oa

[Sumit Kumar @kalki_x0]

I just completed @Pentesterlab's API Badge!!!

[PentesterLab @PentesterLab]

Like a 📚 club, but for 🪲.

Next week, we’re launching The Bug Club: a monthly live session where @snyff discusses interesting vulnerabilities found while building labs, doing research, or going down rabbit holes.

Register here:
https://t.co/HOrhEczyjm

[PentesterLab @PentesterLab]

@satar_nz @hackdartstorm @LoganOpSec Here: https://t.co/8cocIpJ3xC

[PentesterLab @PentesterLab]

Reward hacking, shrinking harnesses, LLM-first SAST and agents that cheat. https://t.co/S1T3TFtQGy

[PentesterLab @PentesterLab]

A dev added return; in front of eval() so user input "can't execute."

PHP hoists class declarations at compile time... Declare a class the app autoloads later, and your constructor runs.

return; stops statements. It doesn't stop declarations.

💥RCE💥

New lab, based on CVE-2026-49273 (MantisBT):

https://t.co/OWext39MZZ

[Abdou Malick @abdou_malick10]

I just completed @Pentesterlab's recon badge!!!

[PentesterLab @PentesterLab]

@coffeefiend52 Congrats! Keep it up!

[coffeefiend52 @coffeefiend52]

I just completed @Pentesterlab's Orange Badge!!!

[PentesterLab @PentesterLab]

First @PentesterLab webinar this week on the impact of AI on offensive security:

https://t.co/QwUAlIX3Q3

[PentesterLab @PentesterLab]

@EliotGeo Congrats!

[Ilias @EliotGeo]

I just completed @Pentesterlab's Web Fundamentals!!!

[PentesterLab @PentesterLab]

https://t.co/iHo2GyXMdi

[PentesterLab @PentesterLab]

@secsystemd Congrats!

[systemd @secsystemd]

I just completed @Pentesterlab's Essential Badge!!!

[Louis Nyffenegger @snyff]

What do you think will be the most impacted by AI?

[PentesterLab @PentesterLab]

How much intelligence does this patch reveal?

In a public repository, a security patch can also become the advisory.

As LLMs make vulnerability reconstruction cheaper, maintainers may need to consider not only whether a fix works, but what it reveals.

New article from @pentesterlab founder @snyff

[Louis Nyffenegger @snyff]

How much intelligence does this patch reveal?

Once a security patch lands in a public repository, it can become the advisory.

LLMs are making it dramatically cheaper to reconstruct vulnerabilities from commits before defenders have deployed the fix.

https://t.co/pyi15iGWFc

[PentesterLab @PentesterLab]

Hear me out..

Back to the Future, but the sports almanac is replaced with the latest release of Metasploit.

[Louis Nyffenegger @snyff]

Get your developers to spend three hours with me.

I promise they'll never look at a pull request the same way again.

If your team is increasingly reviewing AI-generated code, this is the skill they need.

Based on years of analysing CVEs in Go and Python...

[PentesterLab @PentesterLab]

In 2026, secure coding training makes no sense.

Developers increasingly review AI-written code rather than write everything from scratch.

The skill that matters now is reading code with a critical eye and spotting dangerous assumptions.

That’s why we launched two live Security Code Review for Developers trainings:
🐹 Go
🐍 Python

Real CVEs. Real vulnerable code. No made-up examples.

https://t.co/sQLrGj7J6w

[PentesterLab @PentesterLab]

https://t.co/nUvYR5n7uw