SecDim (@secdim) header
SecDim (@secdim) profile picture

SecDim

@secdim

Developer security wargame where developers practice real-world security incidents.

 Sydney, Australia (HQ)
secdim.com
Joined October 2014
  • Tweets466
  • Following3
  • Followers284
278Media
Photo by SecDim (@secdim)Photo by SecDim (@secdim)Photo by SecDim (@secdim)Photo by SecDim (@secdim)Photo by SecDim (@secdim)Photo by SecDim (@secdim)Photo by SecDim (@secdim)Photo by SecDim (@secdim)Photo by SecDim (@secdim)Photo by SecDim (@secdim)
We found a ReDoS in OpenTelemetry for Python: one oversized tracestate header can stall an asyncio server for seconds. Fixed in opentelemetry-api 1.45.1 (CVE-2026-114603). Technical writeup:
Image from SecDim (@secdim)
1
84
Read the full article: secdim.com/blog/post/opentel…
OpenTelemetry Python: Quadratic tracestate Parsing Lets One Request Stall a Server | SecDim

OpenTelemetry Python: Quadratic tracestate Parsing Lets One Request Stall a Server | SecDim

SecDim Security Research reported CVE-2026-114603, a ReDoS vulnerability in the OpenTelemetry Python API, on 2026-10-03 and the vulnerability was subsequently...

secdim.com
22
New C++ challenge: Anushiya.cpp. One process handles requests one after another, and each request's memory should leave no trace. Find the vulnerabilities in the cleanup and fix them. Built from PHP2Shell (CVE-2026-109618, CVE-2026-109619).
Image from SecDim (@secdim)
1
1
124
Read the full article: secdim.com/news/anushiyacpp-…
Anushiya.cpp: a new C++ challenge inspired by PHP2Shell | SecDim

Anushiya.cpp: a new C++ challenge inspired by PHP2Shell | SecDim

Anushiya.cpp is a new C++ challenge on SecDim Play. A process handles one request after another, and each request gets...

secdim.com
22
An open redirect lends your domain to someone else's phishing link. If a login flow sends users to an unchecked destination from the request, it can end on any site. New Python challenge, inspired by CVE-2026-28415 in Gradio:
Image from SecDim (@secdim)
1
64
Read the full article: secdim.com/news/open-redirec…

Open redirect in a Python OAuth flow | SecDim

We have released a new open redirect challenge in the Python, built around an OAuth login flow. An open redirect...

secdim.com
20
We found two DoS bugs in the toml parser for Node.js: a ~100 KB settings file freezes the process for seconds, a ~200 KB one crashes it. Fixed in toml 5.0.1 (CVE-2026-114143, CVE-2026-114141). Technical writeup:
Image from SecDim (@secdim)
1
53
Read the full article: secdim.com/blog/post/dos-in-…
DoS in toml Parser: Quadratic Parsing Lets One Document Stall a Node.js Process | SecDim

DoS in toml Parser: Quadratic Parsing Lets One Document Stall a Node.js Process | SecDim

SecDim Security Research reported CVE-2026-114143 and CVE-2026-114141, two DoS vulnerabilities in the toml parser for Node.js on 2026-09-11 and the...

secdim.com
26
Four new PHP challenges: a TOCTOU race, a Unicode username takeover, server-side request forgery and command injection. Three are inspired by real incidents at Steam, Spotify and Capital One.
Image from SecDim (@secdim)
1
530
Read the full article: secdim.com/news/four-new-php…
Four new PHP challenges, three from real incidents | SecDim

Four new PHP challenges, three from real incidents | SecDim

Four new challenges are live in the PHP game: Steam.php, Insecure Normalization.php, Capital0.php and Command Injection.php. The first three are...

secdim.com
47
AWS secures the cloud. What you run in it is yours to secure, and S3, IAM, VPC and EC2 each need different hardening. We've updated the nine challenges in our AWS game. Link in the reply.
Image from SecDim (@secdim)
1
1
54
secdim.com/news/nine-aws-cha…
Nine AWS challenges, updated | SecDim

Nine AWS challenges, updated | SecDim

We have updated the nine challenges in the AWS game on SecDim Play. AWS is responsible for the security of...

secdim.com
28
discuss.secdim.com/t/glasswo…
GlassWorm and a new incident response challenge

GlassWorm and a new incident response challenge

GlassWorm is a software supply-chain worm targeting developers through malicious packages and extensions. It spreads through malicious VS Code extensions and npm packages. It has a hidden payload...

discuss.secdim.com
5
We will be hosting a 2 day workshop on vibe coding security at NDC London🇬🇧 Come by Room 10 to say Hi if you are attending 👋 👉 secdim.com/news/ndc-london-2… #appsec #securecoding #ndclondon
Image from SecDim (@secdim)
2
43
Rails wraps a non-Hash JSON body under _json, and a client can send that key itself. One request, two readings. If authz and the action read different ones, that's a bypass. New Ruby challenge:
Image from SecDim (@secdim)
1
1
48
secdim.com/news/three-new-ru…
Three new Ruby challenges, Including JSON smuggling | SecDim

Three new Ruby challenges, Including JSON smuggling | SecDim

We have released three new challenges in the Ruby game: Chapar Khaneh Manifest.rb, Chapar Archive.rb and Divan Export.rb. Chapar Khaneh...

secdim.com
29
We will be speaking AISA CyberCon 2026 in Melbourne 🇦🇺 Only 1 week left!
Image from SecDim (@secdim)
1
1
44
melbourne2026.cyberconferenc…
40,000 CVEs and counting: What 60 years of AppSec tells us | CyberCon 2026

40,000 CVEs and counting: What 60 years of AppSec tells us | CyberCon 2026

Sixty years of AppSec history shows which vulnerability problems are structural, which are self-inflicted, and where security investment finally pays off.

melbourne2026.cyberconference.com.au
20
GlassWorm needed no vulnerability. It shipped as a VS Code extension, hid its loader in invisible Unicode, then spread itself with stolen GitHub tokens. New Incident Response challenge:
Image from SecDim (@secdim)
1
45
secdim.com/news/glassworm-an…
GlassWorm and a new incident response challenge | SecDim

GlassWorm and a new incident response challenge | SecDim

GlassWorm is a software supply-chain worm targeting developers through malicious packages and extensions. It spreads through malicious VS Code extensions...

secdim.com
13
Load more