threatactor.club

Hey, followers at #OWASP AppSec Vienna, come see my talk about browser-based XSS protections.

I will talk about Content Security Policy, Trusted Types and the Sanitizer API at 3:30pm in Hall G1.

@christopherkunz @janl Die Lösung liegt natürlich auf der Hand. Weniger updaten. 🫣

How do we know that we detect what we intend to detect? There are quite a few answers to that question, regrettably also along the lines of “we’ve implemented the detection, d’oh!”.

In the last two years we have been (and continue to be) busy with improving efficiency and effectiveness in detection engineering. The traditional manual approach clearly doesn’t cut it in a large heterogeneous IT landscapes of today, where security monitoring makes use of more than one or two technologies to gain visibility in a variety of system contexts. We thus quickly moved towards Detection as Code (DaC). The question of how a CI/CD pipeline in this context would look like then swiftly confronted us with the question of testability of detection mechanisms, which led to the question of how to automate tests. Having solved that, we arrived at: “if we agree that we want to verify detection effectiveness anyways, why don’t we define a test for a potential attacker action first, if and only accept detections for that specific vector, if they pass the test?“

Adapting from Kent Beck‘s concept of Test-Driven Development (TDD) in software engineering, we refer to our approach as Test-Driven Detection Engineering (TDDE).

We’ve written up the what and how in a short paper together with @seecurity, which we decided to submit to DIMVA as a mere poster, as all of that is WIP. We‘re happy that our submission has been accepted and I’m looking forward to discuss the approach with attendees and fellow practitioners.
Find a preprint of the short-paper here: https://tilmanfrosch.de/dl/preprint/Test_Driven_Detection_Engineering.pdf

*Studentische Tätigkeit bei Mozilla / Firefox Security*

Momentan suche ich ein/e Werkstudent/in für mein Team bei Mozilla im Bereich Firefox Application Security. Die Stelle richtet sich nicht nur an Studierende mit Security-Vorerfahrung. Als Anforderung gilt, dass Bewerber/innen in Deutschland an einer Universität eingeschrieben sind.

Die Stelle richtet sich nicht nur an Studierende mit Security-Vorerfahrung. Siehe Stellenausschreibung hier https://www.mozilla.org/en-US/careers/position/gh/7998284/

*Student Worker Position in the Mozilla Firefox Application Security Team*

I'm hiring for a part-time student role in Mozilla's Firefox Application Security team in Berlin/Germany (remote possible). We are trying to reach students from a broad range of backgrounds, not only people who already see themselves as "security people". It is required that applicants are enrolled in a university in Germany.

https://www.mozilla.org/en-US/careers/position/gh/7998284/

📣 Meine Firma Friday Deployments stellt ein

Ich suche die erste Person für mein Team: einen DevOps-Engineer (m/w/d), remote in Deutschland, Vollzeit/Lifestyle-Teilzeit.

🎯 Fokus: GitLab (inkl. Enterprise-Features), Schulungen, Consulting

💸 Gehalt: bis zu 50k Fix + Gewinn- & Umsatzbeteiligung (nach oben theoretisch offen), flexibler Urlaub, Hardware nach Wahl, kein Micromanagement.

Mehr hier: https://friday-deployments.com/karriere

#FediHire #GetFediHired

The S in interoperability (https://frederikbraun.de/the-s-in-interoperability.html): A blog post about standards, their proliferation and the issues that arive over time.

🚨 CVE-2026-48710 ("BadHost"): one character in a Host header bypasses path-based auth across most of the internet's Python AI stack.

In Starlette → FastAPI → vLLM, LiteLLM, TGI, MCP servers, agent harnesses. Found by X41 during a vLLM audit.

Patch shipped after 4 months quietly as CVSS 6.5 scoped as a "web framework problem"; but discoverers say critical.

https://secwest.net/starlette

Fix: Starlette 1.0.1.
Scanner: https://badhost.org
Semgrep+CodeQL: https://github.com/x41sec/poc/tree/master/starlette-host-header

Hat Tip: @marver

Phrack wants your art!

The theme for this issue is retro sci-fi / old-school cybernetic futures.

CRT glow, vector grids, space paranoia, BBS aesthetics, analog cyberpunk, forgotten futures. But we accept all kinds of contributions :)

ANSI, illustration, collage, renders, weird experiments.

Send it to: arts@phrack.org

Deadline June 30th

In my day job I work for an Australian IT company.

I come from a LAN down under.

Aloha! I expect this account to be rather low-traffic.

Patch Starlette now! If you're run it via uvicorn or other common ASGI servers then a host header parsing issue can lead to vulnerabilities leading from auth bypass up until RCE! Examples for affected packages are liteLLM, vllm, etc... Here is the X41 Advisory:

https://x41-dsec.de/lab/advisories/x41-2026-002-starlette/

They: "On a scale from 1 to 10: How lazy are you?"

Me: Using the copy fail exploit instead of sudo to avoid having to type my password

#copyfail #linux #cybersecurity