Laura Verheyde

What is Trojan Source and how does it sneak into your source code

Understand the path traversal bug in Python’s tarfile module

Recently, a team of security researchers announced their finding of a fifteen year old bug in Python’s tar file extraction functionality. The vulnerability was first disclosed in 2007 and tracked as CVE-2007-4559. A note was added to the official Python documentation, but the bug itself was left unpatched.

Hardcoded credentials can introduce security risks

Learn more about the risks associated with hardcoded credentials and social engineering as we discuss Uber's recent security incident and why it's so important for organizations to shift left and ensure their developers are up-to-date on secure coding best practices.

The Log4j vulnerability explained - Its attack vector and how to prevent it

In December 2021, a critical security vulnerability Log4Shell was disclosed in the Java library Log4j. In this article, we breakdown the Log4Shell vulnerability into the simplest form for you to grasp the basic and introduce you to a mission - a playground where you can try exploiting a simulated website using the knowledge of this vulnerability.

Deep-Dive: Up close and personal with the MOVEit zero-day vulnerability

The MOVEit scenario is a little different from what many developers and AppSec professionals may have previously experienced, and you can test your SQLi-slaying skills in a live simulation right here.

Deep-Dive: Finding and fixing high-severity libcurl/curl vulnerabilities

Affected versions of the curl library are susceptible to a Heap-based buffer overflow vulnerability, related to a legacy issue with the SOCKS5 proxy protocol. Learn how to find and fix this vulnerability type with a playable mission.

Deep-dive: Navigating vulnerabilities generated by AI coding assistants

Explore the security risks of AI in software development and learn how to navigate these challenges effectively with Secure Code Warrior.