User prompt CSRF on Le Chat and Grok

Published: Jul 17 2026

Reprompt-style vulnerability in Le Chat (Mistral) and Grok.

llama.cpp quickstart (part 2)

Published: Jul 16 2026

How to quickly use llama.cpp for LLM inference (part 2). This is a follow-up of a previous post on the same topic.

Malleability of ECDSA (and DSA) signatures, JWTs, etc.

Published: Jun 27 2026

This blog posts explains that ECDSA and DSA signatures are malleable, that JWTs can be malleable as well and how this can be used to bypass some broken implementations of JWT deny lists (for revocation of JWTs or anti-replay protection).

Risk of reflected cross site scripting and Content-Security-Policy bypass in the WebSub intent verification

Published: Jun 3 2026

I was reading the WebSub specification (formerly PubSubHubbub) when I found that there was a risk of reflected browser-side code injection (reflected cross site scripting, reflected XSS) in the WebSub intent verification exchange.

Computer security guidelines and references

Published: May 28 2026

A list of computer security guidelines and references.

Authority Ambiguity Vulnerabilities in NGINX and Debian’s proxy_params

Friends don't let friends use $http_host

Published: May 28 2026

Two related authority-ambiguity vulnerabilities in NGINX and Debian's proxy_params configuration snippet.

Cryptography formats

Published: May 19 2026

If you are trying to understand the difference between the different cryptography-related formats (PKS#12, PKCS#8, PEM, X.509 certificate, DER, JWK, BEGIN ENCRYPTED PRIVATE KEY??? 🤯), you will hopefully find some useful information here (and a lot more your did not wanted to know about).