CTFs Are Not Dead, They’re Just Growing Up
Are LLMs killing CTFs? Or are they just forcing them to evolve? Exploring the new landscape of cybersecurity competitions.
caverav
Security Researcher and Application Security Engineer
Latest posts
CVE-2026-0540: How a CTF Detour Led Us to a DOMPurify mXSS - Daft
A detailed write-up of the DOMPurify mXSS we found during a CTF detour, affecting 3.1.3 through 3.3.1 and fixed through a small patch series in 3.3.2.
CVE-2025-15265: Svelte Hydratable Key SSR XSS - Lydian
A technical write-up of the Svelte async SSR XSS I discovered in hydratable() key serialization, affecting versions 5.46.0 through 5.46.3.
CVE-2025-67635: Unauthenticated DoS in the Jenkins CLI full-duplex endpoint
[Race conditions](https://db.fluidattacks.com/wek/124/) and missing timeouts in Jenkins' plain CLI endpoint let anyone exhaust servlet threads without Overall/Read.
CVE-2025-9624: Nested Boolean/Disjunction Asymmetric DoS in Amazon's OpenSearch query_string - Chick
How I found CVE-2025-9624, an asymmetric Denial of Service in Amazon's OpenSearch's query_string handling, and how it was fixed with search.query.max_query_string_length.
The Obsolescence of SSL Pinning in Mobile App Security
TL;DR This blog post is dense and time-consuming to read in full. If you just need the essentials: SSL Pinning is obsolete : Google, Apple, OWASP, and Cloudflare all discourage its use except in rare cases. Why? It's fragile (breaks when certificates rotate), high-maintenance, gives a false sense of security (easily bypassed with tools like Frida), and can cause outages or compatibility failures…
CVE-2025-9375: XML Injection Vulnerability in xmltodict 0.14.2 - Mono
Executive Summary I discovered an XML Injection vulnerability in xmltodict version 0.14.2, a popular Python library with over 1.5 million weekly downloads on PyPI. This vulnerability allows attackers to inject arbitrary XML markup through crafted dictionary keys, potentially leading to XML structure manipulation, data corruption, and in web contexts, cross-site scripting (XSS) attacks. The…
CVE-2025-7969: Markdown-it Fence Rendering XSS - Fito
TL;DR Markdown-it 14.1.0 contains an XSS vulnerability (CVE-2025-7969) that enables arbitrary JavaScript execution through a fence rendering bypass. This post provides a technical deep dive into the vulnerability, exploitation techniques, and real-world impact scenarios. Technical Analysis The Core Vulnerability The vulnerability exists in the library's fence rendering logic. Markdown-it uses a…
CVE-2025-8101: Linkify.js Prototype Pollution & XSS - Charly
TL;DR Linkify.js 4.3.1 contains a prototype pollution vulnerability (CVE-2025-8101) that enables remote code execution through XSS. This post provides a technical deep dive into the vulnerability, exploitation techniques, and real-world impact scenarios. Technical Analysis The Core Vulnerability At its core, the vulnerability exists in the library's attribute assignment logic. Linkify.js uses a…