🔥The 9th Round of Easy Loan, Earn $40 Reward is in progress❗️ ⏰ Promotion Period: January 15th - Feburary 15th, 2025 👉 Register now and check more details at gate.io/campaigns/358

AI vs Mayonnaise

🥳 This will make using side-channel techniques such as Timing Attacks, XS-Leaks, and COSI harder!

Mastodon、RCEとXSSのセキュリティ修正があります。 それに関連してRubyの「sanitize」というgemのHTMLサニタイザーのバイパスも修正されています。 github.com/rgrove/sanitiz…

So I'm starting a Youtube Channel 😄 Join me today at 19:00 CEST (in other words: in three hours) when I'll talk about 10 highlights from my bug hunting career: youtube.com/watch?v=utz3SH…

A few deprecations shipped in Chrome 120. Data URLs in SVG <use> is now blocked. chromestatus.com/feature/512882… CSP Embedded Enforcement's implicit opt-in for same-origin iframes is gone. chromestatus.com/feature/509815…

Mozilla has changed their standards position on Trusted Types to positive 🎉 2024 will be a bad year for DOM-based XSS. github.com/mozilla/standa…

Mozilla decides Trusted Types is a worthy security feature dlvr.it/T0QwgP

See how Google's security engineering team handles rollouts at scale, so we can safely enforce Strict CSP, Trusted Types and other security features on 100s new services yearly. bughunters.google.com/blog/589651289…

Ever wondered how to increase your bug bounties 💸 ? Our latest blog post introduces our domain tiers security concept and how it is applied at Google, and includes a list of Google's highest sensitivity domains. bughunters.google.com/blog/456217538…

koto It took us a while but jQuery 4.0.0 beta is out now: blog.jquery.com/2024/02/06/jqu…

LinkedIn says no to DOM XSS by enforcing Trusted Types! Congratulations to Roman Shafigullin for this achievement 🎉

It's finally happened! NEWAG IP Management just sued us for copyright infringement and unfair competition. Here's a symbolic picture of the lawsuit as a whole: Newag quoting q3k's own code as supposedly their IP :) More: infosec.exchange/@q3k@hackerspa…

So NEWAG (context: media.ccc.de/v/37c3-12142-b…) finally filed a lawsuit against members of Dragon Sector / SPS. It took them a few months from when they said they'll do it, and apparently there were some snafus with addresses, but here we are. 1/n🧵

XSS in Gmail is now $20k (or 50% more for exceptional quality report). Good thing we don't have XSSes anymore.... Or do we? :)

If anyone is following the NEWAG vs Dragon Sector case, this article (in PL, but, well, 2024, google translate) is a really good read about the actual lawsuit and the first day of trial. Second day of trial will be on Jan 15, so there's some time for sides to file more stuff.

Pretty cool exploit chain with the redirects. The writeup is also excellent, and the "screenshots" being actually interactive? 🤯 Thanks a lot for the research, Rebane!

Do you want to learn more about the various Vulnerability Reward Programs offered by Google? Or you're looking for inspiration? Check the video below in which koto and @[email protected] talk about Google VRPs! youtube.com/watch?v=R2qMd4…

Co do jasnej cholery żeby nie napisać dosadniej.

We're sending a HUGE thank you to our incredible community of bughunters ! 🙏 Your passion for finding vulnerabilities keeps our users safe 🔒 To show our appreciation, we awarded over $380,000 in bounties this week, including the largest reward ever given in Google VRP history!

linkedin.com/pulse/proud-da…