2026-10-17T23:55:51Z https://njump.me Cure53🔓 https://njump.me/npub1ll3pr2c46nfjat63f5gwa6n4gw7umjecqa9rcpv6vm3adarwu0qsze5q4k https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/303/390/173/440/234/original/be5531331590b65b.jpg https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/303/390/173/440/234/original/be5531331590b65b.jpg https://njump.me/nevent1qqsza292vwpmrkdrwer6j5yaqewzyh5eys2rjg78g8pv3mn5zqa6eyczyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzm4rpz5 In recognition of bravery, patriotism and an unwavering love of freedom, we have decided to rename Microsoft Teams as Microsoft America.<br/><br/>Please update your SBOM and software directories; this change is immediate and permanent. Thank you for your attention to this matter.<br/><br/>🦅 2026-09-11T12:35:18Z https://njump.me/nevent1qqs8pw2za9xd5xudzps8nvh52kcprfmzsj4s4cujh7pq98alqt0zsxczyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzec0c52 Are there more people in the penetration testing business who are flooded with emails from AI agents wanting to negotiate scope and purchase a penetration test?<br/><br/>Over the past few weeks, we have received a lot of them - and I mean A LOT - each wilder than the last. Almost all of the emails are from Gmail addresses and none of them have ever been seen or read by a human.<br/><br/>Additionally, almost all of these projects are related to cryptography in some way, such as messengers, crypto wallets, post-quantum stuff, file vaults and attestation tools. <br/><br/>If you are also getting flooded with these, would you mind reaching out to share experiences and maybe discuss them with us? 2026-09-09T15:25:51Z https://njump.me/nevent1qqs0zr0hpdfkdezsc46uhacltqqc3h894gdnnkc8lcwlc2k6tftyjygzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzkr9349 We updated our public report repository and there is now lots of new material.<br/><br/>Here you are, meanwhile 253 pentest reports, summary reports and papers:<br/><br/><a href="https://github.com/cure53/Publications/tree/master#publications">https://github.com/cure53/Publications/tree/master#publications</a> 2026-06-23T13:29:48Z https://njump.me/nevent1qqsgz4s5dpnulcszf46vdcvkr6jl3dykz86qqh4jc6du8ux6zm9mxyqzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzcvwuxt In reply to <a href='/nevent1qqstvlc3sq0cwwskq9ctdsvjqyxp9zlag3dn5jglm2hkm7x7svazx2cazhrgr'>nevent1q…hrgr</a><br/>_________________________<br/><br/>This guy, who does not exist, started using DOMPurify just now and he could not be more happy. <br/><br/> <img src="https://dompurify.org/wp-content/uploads/2026/03/Whisk_60a2b5c76c932b4956245dd1bd33624ddr.jpeg"> <br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/754/981/347/515/739/original/e147f6f55d844e6d.jpeg"> <br/> 2026-06-15T16:07:47Z https://njump.me/nevent1qqs9m4gngml7ufdgt227mzwkrfyxxtr8h2lx6pctg9jx23va6nuzqmqzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzpzv2y3 What the f*ck is this now, where do those pages come from?<br/><br/><a href="https://dompurify.org/">https://dompurify.org/</a><br/><br/>And who creates this... art?<br/><br/> <img src="https://dompurify.org/wp-content/uploads/2026/03/hero.png"> 2026-06-15T15:44:25Z https://njump.me/nevent1qqsy4a4vsqnc7wdta728vevhpfwzjgxsqv8c9lg2ygpxhqf7lnm4f5szyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uz2zz457 In reply to <a href='/nevent1qqsf7xrj2jh08wnghgv3v6jjx5cxaqlladpep7w2yzph8aw9057k2dgd96h0h'>nevent1q…6h0h</a><br/>_________________________<br/><br/>Wrong session, this was the one where Chrome and Edge got interested in the topic too.<br/><br/><a href="https://www.dagstuhl.de/en/seminars/seminar-calendar/seminar-details/18321">https://www.dagstuhl.de/en/seminars/seminar-calendar/seminar-details/18321</a> 2026-05-28T15:05:47Z https://njump.me/nevent1qqsf7xrj2jh08wnghgv3v6jjx5cxaqlladpep7w2yzph8aw9057k2dgzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzxr4a8f In reply to <a href='/nevent1qqs0fh936j4ktpsdds0psjfmj56tsklgg9t8xxa9plppzeckftlmr0g53qknn'>nevent1q…qknn</a><br/>_________________________<br/><br/>Between 2016 and the new spec was also another Schloss Dagstuhl session where we both lobbied 🙂 <br/><br/><a href="https://www.dagstuhl.de/seminars/seminar-calendar/seminar-details/12401">https://www.dagstuhl.de/seminars/seminar-calendar/seminar-details/12401</a> 2026-05-28T15:03:27Z https://njump.me/nevent1qqsqu9cntd907pwtqrh82xccgx77n7eert5ramuwm7svm0eva8632pgzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzhlqqx6 RE: <a href="https://hachyderm.io/@evilpie/116652387705118871">https://hachyderm.io/@evilpie/116652387705118871</a><br/><br/>Here is how it all started, like, sort of 😅<br/><br/><a href="https://www.youtube.com/watch?v=KIRvxYqk_Wc">https://www.youtube.com/watch?v=KIRvxYqk_Wc</a> 2026-05-28T13:38:00Z https://njump.me/nevent1qqsg69a02adc3e004u8r6femuzgqz3wyk0h7h2ne50a5enp6uxpwhqczyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzc8v8am You probably not gonna like this, yet somewhat might have anticipated...<br/><br/>We are seeing a stark influx in requests to audit vibe-coded cryptography. <br/><br/>So, vibe-crypto is a thing and will be one for a while.<br/><br/>Do what now? 2026-05-19T12:54:16Z https://njump.me/nevent1qqsy2v5tyuxuy68rr7g94nxzzkmclh22sntdglze4kxqfe555xtu7ygzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzxcx8wx DOMPurify XSS via `selectedcontent` re-clone<br/><br/><a href="https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx">https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx</a><br/><br/>This is one of the most interesting bypasses we have seen in a long time, and it feels that this new HTML element will cause lots of trouble in the future. 2026-05-19T09:29:06Z https://njump.me/nevent1qqs9ytm5yrju63har78jcwzcm5mgpl45gcntqsxg3j4x6340c0ley4qzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzhu0k5y In reply to <a href='/nevent1qqsdj4n59grmxf6kn8dpt9u98prhmk7f7n44ygh56u4lm5f9zg4qzhq9ku703'>nevent1q…u703</a><br/>_________________________<br/><br/>We get those too, plus the family group invites. 2026-05-18T10:45:29Z https://njump.me/nevent1qqsfhq3vp4eh6rk0lqkr2nulmd96cnmceezeezzyf2kffhap6zek6pgzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzgatan5 In reply to <a href='/nevent1qqsxdd56rj9nzwzr64ayqsstclxcxar8x7jqmv0wqufkxjlp0ag62ws6quvey'>nevent1q…uvey</a><br/>_________________________<br/><br/>Do you also receive constant family group invites? They keep coming in on our end, almost daily meanwhile... 2026-05-18T10:26:31Z https://njump.me/nevent1qqsgkczy8z2wzh56az29p8rvy36g5ru3mcg3hsjpyeks2d7edadgq6szyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzcetpxz DOMPurify 3.4.4 is out with again several small in-depth improvements. <br/><br/>These include added stability for IN_PLACE sanitization, improved handling of cross-realm nodes and several newly permitted elements and attributes.<br/><br/><a href="https://github.com/cure53/DOMPurify/releases/tag/3.4.4">https://github.com/cure53/DOMPurify/releases/tag/3.4.4</a> 2026-05-17T10:45:10Z https://njump.me/nevent1qqsw8ln2cjam80vp5ut8a0zfvu095u9gcvjzq859tc37099wdlatt4qzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uztqz0wv We&#39;re already seeing a spike in AI-generated PRs making the ecosystem much more secure.<br/><br/>Words cannot describe how grateful we are for all the contributions.<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/441/363/164/047/574/original/9aa3ccf548114151.png"> <br/> 2026-04-21T06:50:41Z https://njump.me/nevent1qqs8gqxm9ylhsry5rfxnkxd32pycu0qw8dxtrgrhu6qp2vuj75rap2szyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uz2076nf In reply to <a href='/nevent1qqsrxukqxeuzy87vsz46fmsvgknaqdk4mqyktxz03xsgk9wtanzw0ncah5r99'>nevent1q…5r99</a><br/>_________________________<br/><br/>And if you don&#39;t, then Roko&#39;s Basilisk will get you and teach you some manners soon... 2026-04-15T13:44:17Z https://njump.me/nevent1qqswncd0vzk4q9c5dq56dhq409evvap2rzxd432xnrsxppwgc72unaqzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uznf8dtk Here&#39;s everybody&#39;s space heroes having a great time with DJT. <br/><br/><a href="https://edition.cnn.com/2026/04/07/science/video/donald-trump-call-artemis-ii-hnk-digvid">https://edition.cnn.com/2026/04/07/science/video/donald-trump-call-artemis-ii-hnk-digvid</a> 2026-04-07T08:43:15Z https://njump.me/nevent1qqs24fgmwf39gwtxcjkxdc3sqz6dlj0qw3rwcw95qzsxgczpzr7w3pqzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzm7fx2a Does anyone have a contact at pwn.ai?<br/><br/>We would kinda like to have a conversation with them...<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/328/838/685/668/024/original/dba1b210f1efbc8b.png"> <br/> 2026-04-01T09:54:39Z https://njump.me/nevent1qqs0fcpvlkt7wpnrjwn07384hs8dhmcszvyvsn87nh6gma3mjljslgqzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzd2z2xz DOMPurify 2.5.9 and DOMPurify 3.3.2 were released today in a rush to fix a security issue caused by jsdom&#39;s faulty tag parsing. <br/><br/>A total of four people reported the exacty same bug within a window of three days.<br/><br/>One did so via email, thank you. One did so via private security advisory, thank you too.<br/><br/>One however simply published a ticket for everyone to see, the other one just dropped a CVE on us without a working fix release. Thanks for nothing.<br/><br/><a href="https://github.com/cure53/DOMPurify/releases/tag/3.3.2">https://github.com/cure53/DOMPurify/releases/tag/3.3.2</a><br/><br/><a href="https://github.com/cure53/DOMPurify/releases/tag/2.5.9">https://github.com/cure53/DOMPurify/releases/tag/2.5.9</a> 2026-03-05T13:15:16Z https://njump.me/nevent1qqsdj8qg2lf7ny7d0qm78u07fk95h59qrs5jds59haf8da4xddus3qqzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzwk6lgt DOMPurify 3.3.0 will soon be released, with this likely being the most important change in a long time:<br/><br/><a href="https://github.com/cure53/DOMPurify/pull/1150">https://github.com/cure53/DOMPurify/pull/1150</a> 2025-10-09T20:04:34Z https://njump.me/nevent1qqsg5y08wew20zspdph66hq0h33k3zga5t2qms8u5e2czfwawhju4ugzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzxepq5s DOMPurify 3.2.7 has been released today, adding several fixes and improvements.<br/><br/><a href="https://github.com/cure53/DOMPurify/releases/tag/3.2.7">https://github.com/cure53/DOMPurify/releases/tag/3.2.7</a><br/><br/>Thanks to all folks who contributed 💕 2025-09-17T12:15:25Z https://njump.me/nevent1qqsdz25pwj5w9jq4zq3c8ta7ap8s05lvj5fukflyxg2tem2aqzw934qzyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uza6l4mq Small change to HTML with massive impact on eliminating mXSS attacks<br/><br/><a href="https://github.com/whatwg/html/commit/e21bd3b4a94bfdbc23d863128e0b207be9821a0f">https://github.com/whatwg/html/commit/e21bd3b4a94bfdbc23d863128e0b207be9821a0f</a> 2025-05-20T09:24:04Z https://njump.me/nevent1qqswtpp9kdgex5zwp85egsrtzn6p7ze3kr665ru2hz0vr4nzke3yr9szyrl7yydtzh2dxt4029x3pmh2w4pmmnwt8qr550q9nfnw84h5dm3uzhj6rhz DOMPurify 3.2.6 has been release with several smaller fixes and improvements, thanks to all who contributed 💕 <br/><br/><a href="https://github.com/cure53/DOMPurify/releases/tag/3.2.6">https://github.com/cure53/DOMPurify/releases/tag/3.2.6</a><br/><br/>Hopefully this will also help with the CI/CD issues that arose after the fake CVE was posted last week. 2025-05-19T15:28:41Z