Container security is a big deal, with OWASP A9 showing up more and more.  Here is a tool that...

If you have been in my classes, you know that I often point to weev as my example for why not to hac...

Another Weblogic deserialization bug. https://securityaffairs.co/wordpress/84450/breaking-news/oracl...

Hacky Easter is on!  Go get your CTF rolling. https://hackyeaster.hacking-lab.com/hackyeaster/...

The Stack Overflow Survey is out and has some interesting insights https://insights.stackoverflow.co...

PortSwigger has replaced the exercises in the Web Application Security Hacker's Handbook with the ne...

No April Fools here.   Solid primer on using burp Collaborator for blind command injection.&nbs...

Bruce has some thoughts on a well-circulated article suggesting that application security isn't that...

Android malware had almost 150 MILLION Googe Play Store downloads before it is was discovered and pu...

The NSA has open sourced their internal reverse engineering tool.  It's so good, many consultan...

As the network boundary becomes more ephemeral, and attackers don't have obvious kickoff points for...

A new tool for finding malicious JavaScript and securely using external libraries. https://blog.foca...