Proud to share that @Doyensec was trusted by @AnthropicAI as one of the security partners validating #Mythos findings as part of Project #Glasswing!
Contact us to see how our research-driven approach shapes the future of #appsec!
https://t.co/jcWLyebSyA
#doyensec#security#ai
I'm really grateful for what I was able to achieve. Even if it's a collision, getting an RCE live on stage targeting one of the most employed software in the world it's fantastic. I will be in Berlin until tomorrow evening, ping me if you wanna hang out
Our CloudSecTidbits series is back with a bang 💥In the latest edition, we're releasing maSSO - A weaponized Identity Provider (IdP) for security testing! Read all about it and the dangers of Multi-SSO AWS Cognito User Pools.
#doyensec#appsec#security
https://t.co/2e5gVtkAL5
In our @a_denkiewicz's latest post, see how combining AFL++ with GPT-5 Codex sped up triaging the results from fuzzing NASA’s CFITSIO library and uncovered numerous vulnerabilities.
https://t.co/oXnzPaPnr2
#doyensec#appsec#security#fuzzing
🚨 Breaking Secure-Looking Cloud Architectures
At #defcon Singapore Demo Labs, we'll show real security bugs involving AWS Cognito multi-SSO user pools & ELB routing paths, including a Malicious OIDC Server & the ELBaph utility!
🔗 https://t.co/ERZWGh9FvN
#appsec#doyensec
Check out the latest edition of @pagedout_zine featuring Doyensec's own Bartłomiej "Bartek" Górkiewicz (@smnfbb ) vibing on Reversing Python Bytecode, along with plenty of great articles!
https://t.co/4xn81WIxJG
#appsec#doyensec#security#reversing
DOMLogger++ v1.0.9 is now out and available! 🎉
This update fixes a lot of issues, including the historical DevTools bug on Chromium 🔥
It also brings full Caido session handling, which is going to be useful in the near future! 👀
👉 https://t.co/wQHbXqzvkq
1/2
📢It's here! Part 2 of Norbert Szetei's (@73696e65) research into ksmbd. See how customized fuzzing & the appropriate sanitizers led to discovering 23 Linux kernel CVEs, including use-after-frees & out-of-bounds reads/writes.
https://t.co/LmigwJtB2c
#doyensec#appsec#security
🚀We have just released a new Security Advisory for @NASA's CFITSIO library 🛰️. Click the link for details on the Heap Overflow, Type Confusion, Out-of-Bound Writes and other vulnerabilities discovered by our @a_denkiewicz !
https://t.co/7X6YVBzhdo
#doyensec#appsec#security
This research is based on this article https://t.co/9c3PjDeK3r which explains that the magic bytes of a pdf (and webp) file are NOT in the beginning of the file. The article goes on to show that a valid pdf can be valid json
Our @73696e65's latest research has resulted in at least 1⃣5⃣ CVEs in ksmbd🤯, including multiple use-after-frees, bounds checks, type confusion and overflows‼️ Check it out today!
https://t.co/AiobDskF5e
#doyensec#appsec#security#linux
After many late nights and busted apps as security consultant at @Doyensec , I trained my spidey senses 🕷️ to detect when an API code is practically begging for an auth vulns.
Join me at #CONFidence2025 for common pitfalls, and tips for writing secure authz from the start.
As a follow up to @maxenceschmitt 's amazing #CSPT research, we've published a list of resources to help people interested in this class of vulnerabilities. Check it out today for video, tools, challenges and variety of publications!
https://t.co/kAN5e9Yk6l
#Doyensec#appsec
A crazy client-side exploit chain by @busf4ctor & @xssdoctor: CSPT+JSON+SelfXSS → cookie path → XSS
This bug went through CSPT abuse, hidden params, CORs bypass, and CloudFront cache poisoning. Breakdown: