SecDim

Developer security wargame where developers practice real-world security incidents.

[SecDim @secdim]

Read the full article: https://t.co/uGPMp9Yvpz

[SecDim @secdim]

We found two DoS bugs in the toml parser for Node.js: a ~100 KB settings file freezes the process for seconds, a ~200 KB one crashes it. Fixed in toml 5.0.1 (CVE-2026-114143, CVE-2026-114141).

Technical writeup:

[SecDim @secdim]

Read the full article: https://t.co/s0UvtKbMbu

[SecDim @secdim]

Four new PHP challenges: a TOCTOU race, a Unicode username takeover, server-side request forgery and command injection. Three are inspired by real incidents at Steam, Spotify and Capital One.

[SecDim @secdim]

https://t.co/wRAMBLasob

[SecDim @secdim]

AWS secures the cloud. What you run in it is yours to secure, and S3, IAM, VPC and EC2 each need different hardening.

We've updated the nine challenges in our AWS game. Link in the reply.

[SecDim @secdim]

https://t.co/DcHxByCOwx

[SecDim @secdim]

We will be hosting a 2 day workshop on vibe coding security at NDC London🇬🇧

Come by Room 10 to say Hi if you are attending 👋

👉 https://t.co/y7ZXCjuaIE

#appsec #securecoding #ndclondon

[SecDim @secdim]

https://t.co/vyJMorTb8f

[SecDim @secdim]

Rails wraps a non-Hash JSON body under _json, and a client can send that key itself.

One request, two readings. If authz and the action read different ones, that's a bypass.

New Ruby challenge:

[SecDim @secdim]

https://t.co/UaA48dNuSJ

[SecDim @secdim]

We will be speaking AISA CyberCon 2026 in Melbourne 🇦🇺
Only 1 week left!

[SecDim @secdim]

https://t.co/XHW64dhmNc

[SecDim @secdim]

GlassWorm needed no vulnerability. It shipped as a VS Code extension, hid its loader in invisible Unicode, then spread itself with stolen GitHub tokens.

New Incident Response challenge:

[SecDim @secdim]

https://t.co/zLNK8Eggj3

[SecDim @secdim]

Your team writes only part of the code it ships. Dependencies, build tools, CI plugins and AI assistants expand the supply chain you need to defend.

Learn how to map and harden it, including AI-related risks.

[SecDim @secdim]

https://t.co/TCMFuIbYOi

[SecDim @secdim]

At NDC Oslo's three-day Attack & Defence AI Wargame, competitors secured their apps while finding flaws in opponents' apps. Maksim Ohvrill led at the second-evening prize ceremony and received the winner's prize. Try it:

[SecDim @secdim]

https://t.co/7DLvKsTeqp

[SecDim @secdim]

An XML parser that accepts external entities can turn untrusted XML into file access, SSRF or command execution. That was the vulnerability identified in http4k in December 2024.

Try the SecDim Play challenge, available in six languages.