Cure53🔓

And there is fire where we walk.

Website: https://cure53.de/
Github: https://github.com/cure53/
Keybase: https://keybase.io/cure53/
Pronouns: they/them

Public Key

npub1ll3pr2c46nfjat63f5gwa6n4gw7umjecqa9rcpv6vm3adarwu0qsze5q4k

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs0lcs34v2af5ew4ag56y8waf6580wdevuqwj3uqkdxdc7k73hw8sgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntdpu26l

Publishing to

relay.momostr.pink

Author Public Key

npub1ll3pr2c46nfjat63f5gwa6n4gw7umjecqa9rcpv6vm3adarwu0qsze5q4k

Show more details

Last Notes

2026-09-11 12:35:18 GMT

In recognition of bravery, patriotism and an unwavering love of freedom, we have decided to rename Microsoft Teams as Microsoft America.
Please update your SBOM and software directories; this change is immediate and permanent. Thank you for your attention to this matter.
🦅

2026-09-09 15:25:51 GMT

Are there more people in the penetration testing business who are flooded with emails from AI agents wanting to negotiate scope and purchase a penetration test?
Over the past few weeks, we have received a lot of them - and I mean A LOT - each wilder than the last. Almost all of the emails are from Gmail addresses and none of them have ever been seen or read by a human.
Additionally, almost all of these projects are related to cryptography in some way, such as messengers, crypto wallets, post-quantum stuff, file vaults and attestation tools.
If you are also getting flooded with these, would you mind reaching out to share experiences and maybe discuss them with us?

2026-06-23 13:29:48 GMT

We updated our public report repository and there is now lots of new material.
Here you are, meanwhile 253 pentest reports, summary reports and papers:
https://github.com/cure53/Publications/tree/master#publications

2026-06-15 16:07:47 GMT

- reply

This guy, who does not exist, started using DOMPurify just now and he could not be more happy.
https://dompurify.org/wp-content/uploads/2026/03/Whisk_60a2b5c76c932b4956245dd1bd33624ddr.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/754/981/347/515/739/original/e147f6f55d844e6d.jpeg

2026-06-15 15:44:25 GMT

What the f*ck is this now, where do those pages come from?
https://dompurify.org/
And who creates this... art?
https://dompurify.org/wp-content/uploads/2026/03/hero.png

2026-05-28 15:05:47 GMT

- reply

Wrong session, this was the one where Chrome and Edge got interested in the topic too.
https://www.dagstuhl.de/en/seminars/seminar-calendar/seminar-details/18321

2026-05-28 15:03:27 GMT

- reply

Between 2016 and the new spec was also another Schloss Dagstuhl session where we both lobbied 🙂
https://www.dagstuhl.de/seminars/seminar-calendar/seminar-details/12401

2026-05-28 13:38:00 GMT

RE: https://hachyderm.io/@evilpie/116652387705118871
Here is how it all started, like, sort of 😅
https://www.youtube.com/watch?v=KIRvxYqk_Wc

2026-05-19 12:54:16 GMT

You probably not gonna like this, yet somewhat might have anticipated...
We are seeing a stark influx in requests to audit vibe-coded cryptography.
So, vibe-crypto is a thing and will be one for a while.
Do what now?

2026-05-19 09:29:06 GMT

DOMPurify XSS via `selectedcontent` re-clone
https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx
This is one of the most interesting bypasses we have seen in a long time, and it feels that this new HTML element will cause lots of trouble in the future.

2026-05-18 10:45:29 GMT

- reply

We get those too, plus the family group invites.

2026-05-18 10:26:31 GMT

- reply

Do you also receive constant family group invites? They keep coming in on our end, almost daily meanwhile...

2026-05-17 10:45:10 GMT

DOMPurify 3.4.4 is out with again several small in-depth improvements.
These include added stability for IN_PLACE sanitization, improved handling of cross-realm nodes and several newly permitted elements and attributes.
https://github.com/cure53/DOMPurify/releases/tag/3.4.4

2026-04-21 06:50:41 GMT

We're already seeing a spike in AI-generated PRs making the ecosystem much more secure.
Words cannot describe how grateful we are for all the contributions.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/441/363/164/047/574/original/9aa3ccf548114151.png

2026-04-15 13:44:17 GMT

- reply

And if you don't, then Roko's Basilisk will get you and teach you some manners soon...

2026-04-07 08:43:15 GMT

Here's everybody's space heroes having a great time with DJT.
https://edition.cnn.com/2026/04/07/science/video/donald-trump-call-artemis-ii-hnk-digvid

2026-04-01 09:54:39 GMT

Does anyone have a contact at pwn.ai?
We would kinda like to have a conversation with them...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/328/838/685/668/024/original/dba1b210f1efbc8b.png

2026-03-05 13:15:16 GMT

DOMPurify 2.5.9 and DOMPurify 3.3.2 were released today in a rush to fix a security issue caused by jsdom's faulty tag parsing.
A total of four people reported the exacty same bug within a window of three days.
One did so via email, thank you. One did so via private security advisory, thank you too.
One however simply published a ticket for everyone to see, the other one just dropped a CVE on us without a working fix release. Thanks for nothing.
https://github.com/cure53/DOMPurify/releases/tag/3.3.2
https://github.com/cure53/DOMPurify/releases/tag/2.5.9

2025-10-09 20:04:34 GMT

DOMPurify 3.3.0 will soon be released, with this likely being the most important change in a long time:
https://github.com/cure53/DOMPurify/pull/1150

2025-09-17 12:15:25 GMT

DOMPurify 3.2.7 has been released today, adding several fixes and improvements.
https://github.com/cure53/DOMPurify/releases/tag/3.2.7
Thanks to all folks who contributed 💕

2025-05-20 09:24:04 GMT

Small change to HTML with massive impact on eliminating mXSS attacks
https://github.com/whatwg/html/commit/e21bd3b4a94bfdbc23d863128e0b207be9821a0f

2025-05-19 15:28:41 GMT

DOMPurify 3.2.6 has been release with several smaller fixes and improvements, thanks to all who contributed 💕
https://github.com/cure53/DOMPurify/releases/tag/3.2.6
Hopefully this will also help with the CI/CD issues that arose after the fake CVE was posted last week.