Python
Python has become one of the most widely used languages in cybersecurity — from writing exploit scripts and automation tools to building security scanners and processing large datasets. Its readability, extensive standard library, and rich ecosystem of security-focused packages make it the go-to language for security professionals.
In application security, Python appears on both sides: as the language used to build web applications (Django, Flask, FastAPI) and as the primary tool for testing them. Common Python security concerns include unsafe deserialization with pickle, command injection through os.system() and subprocess, SSTI in Jinja2 templates, path traversal in file operations, and SSRF in HTTP libraries like requests.
For offensive security, Python powers many essential tools — from Burp extensions and custom fuzzers to reverse shells and exploit proof-of-concepts. Libraries like pwntools, scapy, and impacket are staples in penetration testing. For defensive security, Python is used to build SIEM integrations, log analyzers, and automated incident response workflows.
This page collects Python security resources covering both secure coding practices for Python applications and Python-based security tooling for offensive and defensive work.
python.org
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-07-29 NEW 2026 | How to Set Up Semgrep for AI Code: 13 Steps 60 Min [2026] beginner | This content provides a 13-step guide to setting up Semgrep for AI code, estimated to take 60 minutes. The provided link suggests it's a practical, instructional resource. No specific bug bounty payout amount is mentioned. → tech-insider.org |
| 2026-07-28 NEW 2026 | Tryhackme New Room — FLIP intermediate 3 min read Mobile | Writeup of a TryHackMe room demonstrating a Ciphertext Interaction CBC Attack. This room's challenge involves exploiting an AES CBC implementation where a leaked ciphertext and knowledge of expected plaintext structure allow for manipulation. By XORing parts of the known leaked ciphertext with a derived plaintext, and then XORing that result with a modified plaintext prefix, one can craft a new ciphertext that bypasses the server's validation and retrieves the flag. The technique hinges on understanding how CBC chaining and XOR properties can be leveraged. → infosecwriteups.com |
| 2026-07-28 NEW 2026 | Pickle Rick Tryhackme CTF intermediate 2 min read Deser | Writeup details a CTF challenge exploiting a web server. Reconnaissance using Nmap revealed SSH and HTTP ports. Directory brute-forcing and checking `robots.txt` led to credentials (`R1ckRul3s:Wubbalubbadubdub`) for `login.php`. A command panel on `/portal.php` allowed command injection, enabling a Python reverse shell. Privilege escalation was achieved via `sudo -l`, granting unrestricted root access. The challenge involved finding three ingredients for Rick's potion. → infosecwriteups.com |
| 2026-07-28 NEW 2026 | PyPI Blocks New Files on 14-Day-Old Releases to Prevent Package Poisoning news | PyPI has implemented a new security measure to combat package poisoning attacks. Starting now, new files will not be accepted for releases that are 14 days old or older. This change aims to prevent malicious actors from uploading compromised versions of older packages. The decision was made after discovering instances where attackers attempted to inject malware into established projects by uploading new files to outdated releases, exploiting the trust users have in those versions. → cyberpress.org |
| 2026-07-27 NEW 2026 | PyPI Blocks New File Uploads to Old Releases to Prevent Package Poisoning Attacks news | PyPI has implemented a new security measure to prevent package poisoning attacks by blocking new file uploads to old releases of packages. This change aims to protect users from malicious code being injected into trusted software. Previously, attackers could upload malicious files to older, unmaintained versions of packages, and when users installed those older versions, they would inadvertently download and execute the malicious code. By restricting uploads to old releases, PyPI is making it harder for attackers to compromise the software supply chain. → gbhackers.com |
| 2026-07-22 2026 | Leaking internal headers in Flask Ninja with deserialization intermediate 5 min read Deser | Writeup on a Flask Ninja deserialization vulnerability where an attacker can leak internal headers. By crafting a malicious pickled `BearerAuth` object or influencing its configuration, an attacker can trick the framework's `HttpBearer.__call__` method into reading a header specified in the pickled object instead of the standard `Authorization` header, allowing for the exfiltration of sensitive information like reverse proxy injected headers. This issue impacts Flask Ninja applications that deserialize untrusted input and reflect rejected credentials. |
| 2026-07-16 2026 | HN Security - My Semgrep C/C++ ruleset is ready for prime time again intermediate 5 min read Secrets | Library featuring 50+ Semgrep rules for C/C++ vulnerability research, updated to version 2.0.0. It enhances static analysis by detecting dangerous API calls like `str*`, `mem*`, and `*printf` functions, improves pattern matching for memory allocations, and optimizes performance. The ruleset prioritizes identifying potential vulnerability hotspots over eliminating all false positives, serving as an assistant for developers and researchers rather than a fully automated CI/CD tool. It has been tested against NIST SAMATE test cases and is available in the official Semgrep registry. |
| 2026-07-15 2026 | SUSE python-Pillow Security Update SUSE-SU-2026:2875-1 news 8 min read | Update SUSE-SU-2026:2875-1 addresses four denial-of-service vulnerabilities (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380) in the python-Pillow library, all with CVSS v3.1 scores of 7.5, caused by excessive memory allocation from crafted font or image data. This important security update impacts SUSE Linux Enterprise Desktop, Server, Real Time, and openSUSE Leap 15.3, requiring prompt application via YaST or zypper to mitigate risks on affected SUSE products. |
| 2026-07-02 2026 | Hackers Use Mapbox Dead-Drop C2 and Python RAT to Target Vulnerability Researchers news | Hackers are leveraging a novel technique using Mapbox as a dead-drop command-and-control (C2) infrastructure to target vulnerability researchers. This method utilizes a Python Remote Access Trojan (RAT) to establish communication. By exploiting Mapbox's features, attackers can stealthily receive instructions and exfiltrate data, making it difficult to detect their malicious activities. The primary goal appears to be compromising security professionals within the cybersecurity community. → cybersecuritynews.com |
| 2026-07-02 2026 | Hackers Hide ChocoPoC Malware in Python Dependencies to Compromise Pentesters news | Hackers are embedding ChocoPoC malware within compromised Python dependencies to target penetration testers. This malicious code is hidden in legitimate-looking packages, aiming to infect the systems of security professionals who use these libraries. The goal appears to be gaining access to sensitive information or the networks being tested by these pentesters. No specific bounty payout amount was mentioned in this content. → cyberpress.org |
| 2026-07-01 2026 | Shipping post-quantum cryptography to Python intermediate 4 min read | Library providing post-quantum cryptography support for Python's pyca/cryptography package. This release introduces ML-KEM (NIST-standard key-establishment) and ML-DSA (NIST-standard digital signatures), enabling migration for applications like Ansible and Certbot. While offering quantum resistance, these primitives have larger data sizes and different integration tradeoffs compared to classical algorithms such as Ed25519 and X25519. Future work includes implementing SLH-DSA and protocol integration. → blog.trailofbits.com |
| 2026-06-28 2026 | Programming Languages for Cyber Security: What the Tools Use beginner 6 min read | Library of articles exploring programming languages crucial for cybersecurity tool development and operation. It highlights Python as the dominant language for offensive and defensive tooling, citing examples like Impacket and Volatility 3. Bash and PowerShell are presented as essential for OS interaction, while C and C++ are linked to memory safety vulnerabilities and exploit development. JavaScript is key for web security, SQL for injection attacks and database defence, and Assembly for malware analysis and reverse engineering. Ruby's role is tied to Metasploit, and Rust and Go are positioned as future languages for secure tooling. → latesthackingnews.com |
| 2026-06-27 2026 | BadHost - One character and your AI agent switches sides intermediate 3 min read | Writeup on CVE-2026-48710 (BadHost), a critical vulnerability in Starlette, the Python framework powering FastAPI, vLLM, and LiteLLM. A single character in the HTTP "Host" header can bypass path-based access controls, allowing unauthorized access to sensitive endpoints and data. This impacts numerous AI agent deployments. A scanner by Nemesis and X41 D-Sec can test exposure, and patching Starlette to 1.0.1 or higher, or using `request.scope["path"]`, are recommended fixes. |
| 2026-06-26 2026 | Python.org API Authentication Bypass Could Let Attackers Modify Download Metadata news | A security vulnerability has been discovered in the Python.org API that allows attackers to bypass authentication. This exploit could enable unauthorized individuals to modify download metadata for Python packages. The specifics of the vulnerability and its potential impact are detailed in a report. No bug bounty payout amount was mentioned in the provided content. → cyberpress.org |
| 2026-06-25 2026 | Taming our Python dependencies at Microsoft with AI intermediate 9 min read | Tool, the Python Dependency Remediation extension for Visual Studio Code, uses AI to automatically analyze and update Python dependencies, significantly reducing remediation time and complexity for developers. This solution addresses the challenge of deeply interconnected dependency chains and the accumulation of vulnerabilities that arise from developers avoiding manual updates due to the intricate web of library relationships. → microsoft.com |
| 2026-06-25 2026 | Langflow RCE Flaw Lets Attackers Execute Arbitrary Python Code Without Authentication news | A critical Remote Code Execution (RCE) vulnerability has been discovered in Langflow, a popular tool for building and managing LLM applications. This flaw allows unauthenticated attackers to execute arbitrary Python code on the server hosting Langflow. The vulnerability arises from insecure handling of user-provided inputs, enabling malicious code injection. Exploiting this could lead to complete system compromise. Users are strongly advised to update to the latest version of Langflow to patch this severe security risk. No bug bounty payout amount was specified in the provided content. → gbhackers.com |
| 2026-06-25 2026 | Hunting Leaked PyPI Tokens: 62 Live, 125 Packages Exposed intermediate 4 min read Secrets Supply Chain | Analysis of leaked PyPI tokens reveals 62 live credentials, impacting 125 packages with approximately 25,000 monthly downloads. Using the `pypitoken` Python module, researchers decoded macaroons to identify token restrictions, such as `UserIDRestriction` and `ProjectIDsRestriction`. A method mimicking the `twine upload` command was employed to test token validity, with a 400 HTTP response indicating a live token. Despite GitHub's automated scanning, numerous tokens, many first leaked in 2024, remained active, suggesting gaps in automated detection. Responsible disclosure to the PyPI security team led to token revocation and improvements in their disclosure process. → blog.gitguardian.com |
| 2026-06-23 2026 | AI Patching Reaches Open Source: OpenAI Patch the Planet Targets Python cURL Go news 8 min read | Library for AI-driven vulnerability discovery and patching, Patch the Planet, leverages GPT-5.5-Cyber and Trail of Bits security engineers to identify, validate, and fix issues in open-source projects like cURL, Go, and Python. This initiative addresses the overwhelming influx of AI-generated bug reports by adding a human-review layer for validation and patch development, thereby improving security posture without burdening limited maintainer resources. The project also generates reusable security infrastructure, including fuzzing harnesses and analysis pipelines, benefiting participating open-source communities. → techtimes.com |
| 2026-06-23 2026 | File encryption in Python: An in-depth exploration of symmetric and asymmetric techniques intermediate 7 min read | Library for Python file encryption, detailing symmetric and asymmetric techniques. It covers Amazon's Key Management Service (KMS) with the `aws-encryption-sdk` for envelope encryption, and PyNaCl's `SecretBox` for symmetric file encryption and decryption. Additionally, it explores asymmetric encryption using PyNaCl's public/private box, emphasizing secure key management and communication. → snyk.io |
| 2026-06-22 2026 | Code injection in Python: examples and prevention intermediate 7 min read RCE | Library for identifying and preventing code injection vulnerabilities in Python applications. It details common exploitation vectors, including insecure use of `eval()`, improper handling of user-controlled inputs, lack of input validation, dynamic code construction, and insecure deserialization. The library advocates for secure coding practices such as input sanitization, using safer alternatives like `literal_eval()`, parameterized queries, and strong access controls to mitigate these risks. → snyk.io |
| 2026-06-21 2026 | Command injection in Python: examples and prevention intermediate 10 min read RCE | Library for preventing command injection vulnerabilities in Python applications, detailing how unsanitized user input passed to system shells via methods like `os.system()`, `subprocess.run(shell=True)`, dynamic command construction, and `eval()` can lead to exploits. It covers common scenarios, including vulnerabilities found in MLflow and PaddlePaddle, and emphasizes proactive mitigation through rigorous input validation, sanitization, and the use of parameterized queries to keep commands and data separate. → snyk.io |
| 2026-06-21 2026 | Mastering Python virtual environments: A complete guide to venv, Docker, and securing your code intermediate 6 min read | Library for managing Python virtual environments using `venv`, `virtualenv`, and `pipenv`, and securing Dockerized Python applications with Snyk. It details the creation, activation, and usage of isolated Python environments to prevent dependency conflicts, ensuring reproducible development workflows. The library also covers containerizing Python applications with Docker, including Dockerfile creation and execution, and vulnerability scanning with Snyk to enhance application security. → snyk.io |
| 2026-06-21 2026 | Understanding and mitigating the Jinja2 XSS vulnerability (CVE-2024-22195) intermediate 3 min read XSS | Writeup on CVE-2024-22195, a cross-site scripting vulnerability in the Jinja2 templating library affecting all versions prior to 3.1.3. The vulnerability arises from the `xmlattr` filter when keys contain spaces, allowing attackers to inject arbitrary HTML attributes and execute untrusted scripts. The article details reproduction steps and recommends upgrading to Jinja2 version 3.1.3. It also highlights the utility of tools like Snyk for continuous vulnerability monitoring in projects and containerized applications. → snyk.io |
| 2026-06-19 2026 | The ultimate guide to creating a secure Python package beginner 14 min read | Guide to creating secure Python packages, this tutorial details package structure, naming conventions, and configuration using `pyproject.toml`. It covers importing, installing from PyPI and private indexes with TLS recommendations, and specifying dependencies like NumPy. Modern packaging practices using `setuptools` as a build backend are emphasized over older `setup.py` methods. → snyk.io |
| 2026-06-19 2026 | Symmetric vs. asymmetric encryption: Practical Python examples beginner 14 min read | Library implementing symmetric and asymmetric encryption in Python, demonstrating practical use cases with examples for TLS/SSL, end-to-end messaging, and secure data storage. It covers algorithms like DES, 3DES, and AES, with a focus on envelope encryption for secure key management, using AWS KMS and the AWS Encryption SDK for practical implementation. → snyk.io |
| 2026-06-19 2026 | How to secure Python Flask applications intermediate 14 min read API Sec | Library for securing Python Flask applications, addressing common vulnerabilities like XSS, CSRF, and SQL injection. It details insecure configurations such as secret key exposure, enabled debug mode in production, and unprotected sensitive data in configuration files. The guide recommends best practices including using environment variables for credentials, securely generating secret keys with the `uuid` module, and utilizing the Snyk platform for vulnerability detection and mitigation within IDEs and CI pipelines. → snyk.io |
| 2026-06-18 2026 | Ultralytics AI Library Hacked via GitHub for Cryptomining intermediate 4 min read Supply Chain | Library exploiting GitHub Actions for supply chain attack. Versions 8.3.41 and 8.3.42 of the Ultralytics Python package were compromised, injecting XMRig cryptominer. The attack leveraged a vulnerability in the "Publish Docs" workflow, allowing arbitrary code execution via crafted branch names. This impacted not only Ultralytics but also dependent packages like ComfyUI Impact Pack, highlighting risks in CI/CD pipelines and popular AI libraries. → wiz.io |
| 2026-06-18 2026 | 10 Dimensions of Python Static Analysis beginner 19 min read | Library for static analysis in Python, covering its importance for detecting bugs, security vulnerabilities, and stylistic issues without code execution. It details dimensions like type checking with tools such as Mypy, Pyright, and Pyre, and linting with Pylint, Flake8, and Pyflakes to enforce coding standards and identify code smells. The library also highlights security vulnerability detection capabilities, mentioning tools like Bandit and Snyk Code for spotting risks such as SQL injection. → snyk.io |
| 2026-06-10 2026 | Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign news 3 min read Secrets Supply Chain | Writeup detailing the TeamPCP campaign's exploitation of LiteLLM, specifically versions 1.82.7 and 1.82.8, which utilized Python's .pth mechanism for stealthy code execution. This attack, building on prior compromises of Trivy and Checkmarx GitHub Actions, exfiltrates cloud credentials, CI/CD secrets, and various keys to attacker-controlled domains, posing a significant risk to environments utilizing the LiteLLM library. → wiz.io |
| 2026-06-09 2026 | Shai-Hulud Malware Campaign Abuses 23 PyPI Packages in Developer-Focused Attack news | The Shai-Hulud malware campaign has compromised 23 packages on the Python Package Index (PyPI), targeting developers. This sophisticated attack leverages popular libraries to distribute malicious code, aiming to steal credentials and other sensitive information from unsuspecting users. The campaign highlights the growing threat of supply chain attacks within the open-source ecosystem. Developers are urged to exercise caution, review dependencies, and implement robust security practices to mitigate risks associated with such compromises. → gbhackers.com |
| 2026-06-09 2026 | New Shai-Hulud Attack Compromises 23 PyPI Packages to Target MCP Developers news | A new sophisticated attack, dubbed "Shai-Hulud," has compromised 23 packages on the Python Package Index (PyPI). The malicious code was designed to specifically target developers working on "MCP" (Multi-Chain Platform) projects. This attack highlights a growing trend of supply chain vulnerabilities in open-source ecosystems, where attackers inject malicious code into widely used libraries to compromise downstream users. Developers are urged to audit their dependencies and update to clean versions immediately. → cybersecuritynews.com |
| 2026-06-09 2026 | Snyk and uv, Better Together intermediate 3 min read AI | Library that pairs uv, a high-performance Python package manager, with Snyk for application security. This integration enables native CycloneDX SBOM export from uv, allowing Snyk to scan dependencies for vulnerabilities and license compliance. The partnership also introduces native uv support within the Snyk CLI and IDE integrations, aiming to provide built-in security for AI-native Python applications, ensuring speed and security are not mutually exclusive. → snyk.io |
| 2026-06-09 2026 | How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM news 9 min read RCE Supply Chain | Library containing a backdoor that exploited Trivy security scanner vulnerabilities to compromise LiteLLM Python packages, specifically versions 1.82.7 and 1.82.8. The malicious code was delivered via direct source injection or a `.pth` file, leading to credential theft, data exfiltration using AES-256 and RSA encryption, and persistence through systemd services and Kubernetes lateral movement. This attack chain is linked to the threat actor TeamPCP, identified by consistent infrastructure and an RSA public key shared with prior Trivy and KICS compromises. → snyk.io |
| 2026-06-08 2026 | durabletask: TeamPCP's Latest PyPi Compromise news 2 min read Supply Chain | Analysis of the TeamPCP supply chain attack details the compromise of Microsoft's official Python client, durabletask, specifically versions 1.4.1, 1.4.2, and 1.4.3. The attack leveraged compromised GitHub credentials to exfiltrate PyPI tokens and publish malicious code, targeting Microsoft's `durabletask-python` repository. Remediation steps include identifying exposure via lockfiles and CI logs, checking for persistence markers like `~/.cache/.sys-update-check`, rotating all credentials, auditing AWS SSM and Kubernetes activity, reviewing password manager sessions, and blocking C2 infrastructure. → wiz.io |
| 2026-06-05 2026 | Malicious Python Package Mimics Parsimonious Parser news | A malicious Python package has been discovered that masquerades as the legitimate "Parsimonious" parser library. Attackers are likely using this to compromise systems that depend on the original package. Users are advised to exercise extreme caution and verify the authenticity of any installed "Parsimonious" package. No bounty payout amount is mentioned in this content. → gbhackers.com |
| 2026-06-05 2026 | Type Level Security for Secure AI Code Generation advanced 6 min read | Library implementing type-level security to prevent vulnerabilities like Insecure Direct Object Reference (IDOR) and DOM XSS. It demonstrates code patterns in Python and Rust, showcasing how opaque types and access restrictions can enforce authentication and authorization checks at compile or lint time, ensuring secure data handling for both human developers and AI code generation. → snyk.io |
| 2026-06-01 2026 | Millions of AI agents imperiled by critical vulnerability in open source package news 2 min read | Library implementing ASGI for Python applications, Starlette, is vulnerable to CVE-2026-48710 (BadHost), allowing attackers to bypass authorization via a modified HTTP Host header. This critical vulnerability, trivially exploitable without proper firewalling, impacts FastAPI, vLLM, LiteLLM, and millions of AI agents relying on Starlette, potentially exposing sensitive data and third-party credentials. → arstechnica.com |
| 2026-05-28 2026 | CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV news 3 min read | Writeup of CVE-2026-31431, a Linux kernel privilege escalation vulnerability dubbed "Copy Fail," which allows unprivileged local users to achieve root access by corrupting the kernel's in-memory page cache. The vulnerability impacts Linux distributions shipped since 2017 and has been added to CISA's KEV catalog due to active exploitation. Exploitation is facilitated by a Python-based exploit that uses legitimate system calls, making detection difficult and lowering the entry barrier for attackers, posing significant risks to containerized environments like Docker, LXC, and Kubernetes. → thehackernews.com |
| 2026-05-26 2026 | Starlette vulnerability exposes millions of AI agents to hackers news 2 min read | Library for Python's Starlette framework addresses critical vulnerabilities including CVE-2024-47874 and CVE-2025-62727, which impact AI agents and crypto tools. These flaws enabled denial-of-service attacks through improper handling of large multipart form data and crafted Range headers, respectively. Patched versions are 0.40.0 and 0.49.1, though widespread adoption across thousands of downstream projects may lag, leaving AI-driven trading bots and DeFi automation tools exposed to memory poisoning and unauthorized transactions. → cryptobriefing.com |
| 2026-05-26 2026 | llama.cpp GGUF Parser Flaws: Critical Integer Overflow Enables Arbitrary Reads in Every Local AI Stack advanced 7 min read | Library of six vulnerabilities found in llama.cpp's GGUF parser, including a critical integer overflow (V-01) allowing arbitrary file reads and memory exhaustion flaws (V-02, V-03) affecting tools like Ollama and LM Studio. These issues, including V-01 and V-02, are present in the C++ gguf.cpp and Python gguf_reader.py implementations, and unlike CVE-2026-7482 (Bleeding Llama), do not have assigned CVE numbers, bypassing standard scanning workflows. → techtimes.com |
| 2026-05-22 2026 | Microsoft DurableTask Python Client Targeted in TeamPCP Cyberattack news 2 min read | Writeup on the TeamPCP supply chain attack that compromised the Microsoft DurableTask Python client, specifically versions 1.4.1, 1.4.2, and 1.4.3. The attackers leveraged a compromised GitHub user to gain access to repository secrets, including a PyPI token, allowing them to publish trojanized versions. The payload, an evolution of previous malware, steals cloud credentials from AWS, Azure, GCP, Kubernetes, and Vault, and propagates via AWS SSM and Kubernetes, also attempting to unlock password managers like Bitwarden. → gbhackers.com |
| 2026-05-20 2026 | Microsoft DurableTask Python Client Compromised by TeamPCP news 3 min read | Analysis of TeamPCP's compromise of Microsoft's DurableTask Python client, detailing the supply chain attack that injected malicious versions (1.4.1–1.4.3) into PyPI. The actor exploited compromised GitHub credentials to obtain a PyPI API token, bypassing Microsoft's CI/CD pipeline to upload tainted packages. The malware, featuring a Python zipapp payload, exfiltrated AWS, Azure, GCP, Kubernetes, HashiCorp Vault, and other credentials, and propagated laterally via AWS SSM and Kubernetes. This incident links to the broader Mini Shai-Hulud campaign. → cyberpress.org |
| 2026-05-20 2026 | Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! news 8 min read | Library versions 1.4.1, 1.4.2, and 1.4.3 of Microsoft's `durabletask` Python package on PyPI were compromised with a dropper that executes a sophisticated infostealer and worm. This payload targets credentials from cloud providers, password managers, and developer tools, propagating via SSM or kubectl in cloud environments. It also includes a destructive component triggered by specific system locales. The malware exfiltrates data encrypted with an RSA key and utilizes a GitHub-based dead-drop for command and control. → aikido.dev |
| 2026-05-19 2026 | Max-severity flaw in ChromaDB for AI apps allows server hijacking news 2 min read | Vulnerability in ChromaDB allows unauthenticated attackers to execute arbitrary code on exposed servers, tracked as CVE-2026-45829. This flaw in the Python API server logic enables attackers to embed malicious model settings before authentication, forcing ChromaDB to load and execute a harmful model from platforms like Hugging Face. Mitigation includes using the Rust frontend, restricting network access, and scanning ML model artifacts before runtime. → bleepingcomputer.com |
| 2026-05-13 2026 | JDownloader Hack Spreads New Python RAT news 2 min read | Writeup on the JDownloader supply-chain attack where attackers exploited a CMS vulnerability to distribute malicious installers containing a Python RAT. The attack affected Windows and Linux users who downloaded alternative installers between May 6-7, 2026, with the malware allowing remote code execution and using spoofed signatures. Analysis revealed a modular bot framework with identified C2 endpoints and injected code in the Linux variant disguised as `/usr/libexec/upowerd`. Users are advised to reinstall their operating systems if affected. → gbhackers.com |
| 2026-05-12 2026 | What AI 'fingerprints' helped expose the 1st AI-made zero-day exploit? | The exploit was a Python script beginner | Researchers discovered the first zero-day exploit generated by AI. The exploit was written as a Python script. The article's title suggests that unique "AI fingerprints" were crucial in identifying this novel threat, distinguishing it from human-crafted exploits. This marks a significant development in cybersecurity, highlighting AI's potential for both creating and detecting sophisticated attacks. The specific details of these "fingerprints" and how they led to the exposure of the exploit are likely discussed within the linked content. |
| 2026-05-12 2026 | Microsoft Warns Of Compromised mistralai PyPI Package news 2 min read | Library compromise via Mistralai v2.4.6 on PyPI, flagged by Microsoft, demonstrates a sophisticated supply chain attack. This poisoned package executes hidden malicious code upon import, connecting to 83[.]142[.]209[.]194 to download a second-stage payload named transformers.pyz from /tmp, designed to steal credentials and API keys. The malware also installs persistence mechanisms like pgmonitor.py and pgsql-monitor.service. Organizations are urged to isolate affected hosts, block the malicious IP, search for the payload, and rotate credentials immediately. → cyberpress.org |
| 2026-05-12 2026 | Operation HumanitarianBait Uses Fake Aid Documents to Deploy Python Spyware news 3 min read | Library for detecting Operation HumanitarianBait, a Python spyware campaign targeting Russian speakers with fake humanitarian aid documents. This campaign utilizes LNK files within RAR archives, fileless execution via PowerShell, and obfuscation with PyArmor v9.2 Pro. The malware steals credentials from Chromium and Firefox browsers, exfiltrates Telegram session data, searches for cryptocurrency private keys, logs keystrokes, captures screenshots, and establishes remote access via RustDesk or AnyDesk. Persistence is maintained through Windows Scheduled Tasks and VBScript launchers, with C2 infrastructure hosted by Namecheap. → hackread.com |
| 2026-05-11 2026 | Python Infostealer Uses GitHub Releases To Bypass Security Tools news 2 min read | Library utilizing GitHub Releases to evade security tools, as seen in Operation HumanitarianBait. This Python infostealer employs social engineering, PowerShell memory execution, PyArmor obfuscation, and fileless operation to harvest browser credentials, keystrokes, and Telegram data. It maintains persistence via scheduled tasks and installs legitimate remote desktop applications for covert access, demanding user vigilance and endpoint monitoring for defense. → cyberpress.org |
| 2026-05-10 2026 | JDownloader Website Supply Chain Attack: Installers Replaced with Python RAT Malware (May 2026) news 5 min read | Writeup of the JDownloader website supply chain attack (May 2026), detailing how an unpatched CMS vulnerability allowed attackers to replace Windows and Linux installers with a Python RAT and ELF binaries respectively. The attack, active for approximately 24 hours, utilized obfuscation and persistence techniques, including SUID-root binaries for Linux. This incident highlights the risks of unauthorized changes to web content and the importance of verifying digital signatures. → rescana.com |
| 2026-05-08 2026 | Linux Kernel Elevation of Privilege Vulnerability news 1 min read | Writeup on CVE-2026-31431, a "Copy Fail" logic bug in the Linux kernel's authencesn cryptographic template. This vulnerability allows an unprivileged local user to perform a deterministic, controlled 4-byte write into the page cache of any readable file, enabling elevation of privilege to root. The exploit is a 732-byte Python script that can modify setuid binaries, impacting all Linux distributions shipped since 2017. Vendor-specific fixes are available for Ubuntu, Debian, Red Hat, SUSE, Amazon, Arch, AlmaLinux, Cloudlinux, and Gentoo. → hkcert.org |
| 2026-05-07 2026 | Critical severity vulnerability affecting CPython (CVE-2026-6100) news | Writeup of CVE-2026-6100, a critical use-after-free vulnerability in CPython affecting `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. The vulnerability arises when decompressor instances are reused after a `MemoryError` during decompression, leading to a dangling pointer. Standard one-shot decompression functions like `lzma.decompress()` are unaffected. → systemtek.co.uk |
| 2026-05-05 2026 | Bootstrap script exposes PyPI to domain takeover attacks news 8 min read Supply Chain | Library detailing a domain takeover vulnerability in legacy Python package bootstrap scripts. The vulnerability, discovered by ReversingLabs, affects numerous packages including tornado and slapos.core, by exploiting the now-available python-distribute[.]org domain. This could allow attackers to execute arbitrary code when developers run affected bootstrap scripts, potentially impacting software supply chain security. → reversinglabs.com |
| 2026-05-02 2026 | Script Injection and Data Theft: Python Data Analysis Tool Compromised intermediate 2 min read RCE | Tool update compromise elementary-data (version 0.23.3) allowed script injection via GitHub Actions workflows, leading to theft of SSH keys, AWS credentials, API tokens, and cryptocurrency wallet files. The malicious package was available on PyPI and as a Docker image. Countermeasures include uninstalling the compromised version, installing 0.23.4, renewing credentials, and checking for malware marker files. This incident is cataloged as MAL-2026-3083 in OSV. |
| 2026-05-01 2026 | "Copy Fail": Linux root in all major distributions with 732 bytes of Python intermediate 2 min read RCE | Writeup of CVE-2026-31431, "Copy Fail," a Linux kernel vulnerability allowing local privilege escalation. This logic error enables a deterministic 4-byte write to the page cache of any readable filesystem, exploitable with a 732-byte Python script. The vulnerability, discovered with AI assistance and affecting major distributions since 2017, can be mitigated by blocking AF_ALG socket creation or blacklisting the algif_aead module. |
| 2026-04-30 2026 | Copy Fail: root on virtually any Linux intermediate | A critical vulnerability, dubbed "Copy Fail," has been discovered that allows a local attacker to gain root privileges on virtually any Linux system. The flaw resides in the `copy_file()` function within the Linux kernel's `sys_copy_file_range` system call. By exploiting this vulnerability, an attacker can bypass permission checks and write arbitrary data to any file on the system, effectively achieving root access. This could have severe security implications, allowing for complete system compromise. |
| 2026-04-30 2026 | New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions news 2 min read RCE | Library for detecting and mitigating the "Copy Fail" vulnerability (CVE-2026-31431), a Linux kernel flaw in the algif_aead module. This high-severity issue allows unprivileged local users to gain root access by writing controlled bytes into the page cache of any readable file, targeting setuid binaries like `/usr/bin/su`. The exploit, a small Python script, corrupts the page cache of files it doesn't own, bypassing sandboxing and affecting distributions shipped since 2017, including RHEL and Ubuntu. → thehackernews.com |
| 2026-04-29 2026 | LeRobot Vulnerability Enables Unauthenticated Remote Code Execution news RCE | A critical vulnerability in LeRobot allows unauthenticated remote code execution. This means attackers can exploit the flaw to run their own code on a vulnerable LeRobot system without needing any credentials. The specific details of the exploit and its impact are available via the provided link. → letsdatascience.com |
| 2026-04-28 2026 | Malicious Python package poses new supply chain threat news 2 min read Supply Chain | Writeup detailing a supply chain attack on the `elementary-data` Python package, which was compromised via a GitHub Actions vulnerability. Attackers stole signing keys to publish a malicious version (0.23.3) that exfiltrated user profiles, cloud keys, API tokens, SSH keys, and .env file contents. Users are advised to rotate credentials, remove the malicious package, and check for a marker file, noting CI/CD runners are particularly at risk. → techzine.eu |
| 2026-04-24 2026 | Python Vulnerability Allows Out-of-Bounds Write on Windows Systems news 2 min read | Writeup of CVE-2026-3298, an out-of-bounds write vulnerability in Python's Windows asyncio implementation. The flaw, discovered in the `sock_recvfrom_into()` method of `asyncio.proactorEventLoop`, occurs due to a missing boundary check when the `nbytes` parameter is used, potentially allowing attackers to corrupt memory, leading to crashes or code execution. Only Windows users running Python with affected asyncio network applications are at risk. A fix is available via a pull request to the CPython repository. → cybersecuritynews.com |
| 2026-04-24 2026 | Critical Python Vulnerability Enables Out-of-Bounds Write on Windows Systems news 2 min read | Analysis of CVE-2026-3298, a critical out-of-bounds write vulnerability in Python's asyncio module on Windows. The flaw in `sock_recvfrom_into()` allows attackers to trigger memory corruption and potential code execution by sending oversized network data. This affects applications using the default `ProactorEventLoop` since Python 3.8. A patch has been submitted to CPython. → cyberpress.org |
| 2026-04-24 2026 | Python Vulnerability Enables Out-of-Bounds Write on Windows news 2 min read | Writeup on CVE-2026-3298, a high-severity out-of-bounds write vulnerability affecting Python's `asyncio.ProactorEventLoop` on Windows. This flaw in the `sock_recvfrom_into()` method allows attackers to overwrite adjacent memory regions if incoming network data exceeds a pre-allocated buffer. Affecting Windows-hosted servers, API backends, and UDP socket applications, the vulnerability can lead to memory corruption or code execution. A fix has been submitted via GitHub Pull Request #148809, and users should monitor for patched Python releases. → gbhackers.com |
| 2026-04-23 2026 | wapiti-scanner/wapiti: Web vulnerability scanner written in Python3 beginner 5 min read API Sec | Library for "black-box" web vulnerability scanning in Python3, acting as a fuzzer to detect issues like SQL Injections, XSS, File Disclosure, Command Execution, XXE, CRLF Injection, Shellshock, SSRF, and Log4Shell (CVE-2021-44228) by attacking scripts and forms. It supports various reporting formats, session management for resuming scans, proxy integration, authenticated scans, URL scope limitation, cookie import from browsers, and includes modules for CMS enumeration, subdomain takeover detection, and security header checks. |
| 2026-04-22 2026 | CVE-2025-68664: Critical LangChain Flaw Enables Secret Extraction news 4 min read | Writeup of CVE-2025-68664, a critical serialization injection vulnerability in LangChain Core, enabling secret extraction and unintended object instantiation. The flaw, stemming from improper handling of the "lc" key during data serialization and deserialization, affects Python versions >= 1.0.0 and < 1.2.5 and < 0.3.81, and a similar issue, CVE-2025-68665, impacts LangChain.js. Exploitation involves crafting attacker-controlled LLM outputs that masquerade as trusted objects, leading to risks like secret leakage and network operations. Patched versions implement deserialization allowlists and disable environment-based secret loading by default. → socradar.io |
| 2026-04-22 2026 | Bandit Python: Free SAST in 10 Seconds (2026 Review) beginner 3 min read | Library for static analysis of Python code, Bandit identifies common security issues through Abstract Syntax Tree analysis. It ships with 47 built-in checks targeting vulnerabilities like hardcoded credentials, weak cryptography, and injection flaws, with specialized plugins for issues such as insecure Hugging Face model downloads (B615). Bandit offers flexible configuration, multiple output formats including SARIF, baseline comparisons for incremental scans, and integrates with pre-commit hooks and Docker. It’s recommended for Python projects needing a free, focused security linter to complement broader SAST solutions. → appsecsanta.com |
| 2026-04-22 2026 | CVE-2026-22607: Fickling Python RCE Vulnerability news 4 min read | Writeup of CVE-2026-22607 details an Insecure Deserialization vulnerability in Fickling, a Python pickling decompiler. Versions up to 0.1.6 incorrectly classify pickle files using `cProfile.run()` as "SUSPICIOUS" instead of "OVERTLY_MALICIOUS". This misclassification allows attackers to craft malicious pickle files, bypass Fickling's analysis, and achieve arbitrary code execution on systems relying on its security assessment for deserialization. → sentinelone.com |
| 2026-04-22 2026 | CVE-2026-21226: Azure Core Python Library RCE Vulnerability news 4 min read | Library for Python applications using Azure SDKs, addressing CVE-2026-21226, an insecure deserialization vulnerability (CWE-502). Attackers with low-level authorization can execute arbitrary code over a network by crafting malicious serialized payloads processed by the vulnerable Azure Core library. Mitigation involves updating the `azure-core` package via `pip install --upgrade azure-core` and implementing input validation or network segmentation. → sentinelone.com |
| 2026-04-22 2026 | SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files news 2 min read RCE | Writeup on CVE-2026-5760, a CVSS 9.8 remote code execution vulnerability in SGLang. Attackers exploit this by crafting malicious GGUF model files with Jinja2 server-side template injection payloads in the `tokenizer.chat_template` parameter. Loading these models and hitting the `/v1/rerank` endpoint allows arbitrary Python code execution on the SGLang server, similar to CVE-2024-34359 (Llama Drama) and CVE-2025-61620 in vLLM. Mitigation involves using `ImmutableSandboxedEnvironment` for rendering templates. → thehackernews.com |
| 2026-04-22 2026 | Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure news 3 min read RCE | Writeup on CVE-2026-39987, a pre-authenticated RCE vulnerability in Marimo exploited within 10 hours of disclosure. The flaw, unpatched until version 0.23.0, allowed unauthenticated attackers to gain a full PTY shell by connecting to the `/terminal/ws` WebSocket endpoint without proper authentication. Attackers leveraged the exploit for credential theft, environment variable extraction, and deployment of the NKAbuse variant via Hugging Face Spaces, with CISA adding it to the KEV catalog. → thehackernews.com |
| 2026-04-22 2026 | Critical SQL Injection Vulnerability in Django (CVE-2025-64459) news 4 min read | Library detailing CVE-2025-64459, a critical SQL injection vulnerability in Django that allows attackers to manipulate query logic via internal parameters like `_connector` and `_negated`. The analysis covers exploitation scenarios such as authentication bypass and data exfiltration, outlines the fix implemented in patched Django versions (5.2.8, 5.1.14, 4.2.26), and provides mitigation strategies including code review, parameter whitelisting, and testing for vulnerable patterns. → endorlabs.com |
| 2026-04-22 2026 | Malicious PyPI Packages Deliver SilentSync RAT news 7 min read | Library for Python package installers that delivers the SilentSync RAT. Malicious PyPI packages named `sisaws` and `secmeasure`, uploaded by the same author, are used to deploy SilentSync. This RAT enables remote command execution, file exfiltration, screen capturing, and web browser data theft from Chrome, Brave, Edge, and Firefox on Windows systems. The malicious packages leverage typosquatting and mimic legitimate library functionalities to evade detection. |
| 2026-04-22 2026 | Bearer: SAST Tool to Discover, Filter, and Prioritize Security and Privacy Risks beginner 8 min read | Tool for static application security testing (SAST), Bearer scans source code to identify, filter, and prioritize security and privacy risks. It supports multiple languages including Go, Java, JavaScript, TypeScript, PHP, Python, and Ruby, with advanced cross-file analysis and additional languages available in its commercial version. Bearer CLI detects vulnerabilities based on OWASP Top 10 and CWE Top 25, such as Path Traversal (CWE-22), SQL Injection (CWE-89), and Cross-Site Scripting (CWE-79), and also identifies PII and PHI data flows for privacy compliance reporting. |
| 2026-04-19 2026 | PyPI Supply Chain Attack: Colorama and Colorizr Name Confusion news 5 min read | Library of malicious Python packages exploiting typo-squatting and name-confusion attacks against the Colorama library on PyPI. These packages, designed to mimic legitimate libraries, deliver payloads for persistent remote access, data exfiltration, and attempts to evade antivirus controls on both Windows and Linux systems. The campaign exhibits cross-ecosystem tactics, using NPM package names to target PyPI users, and features sophisticated persistence mechanisms and stealth techniques. → checkmarx.com |
| 2026-04-19 2026 | Compromised LiteLLM PyPI Package Delivers Credential Stealer news 6 min read Supply Chain | Library versions 1.82.7 and 1.82.8 of the popular Python package litellm, an abstraction for interacting with LLMs from providers like OpenAI and Google, were compromised on PyPI. This malicious code acted as a multi-stage credential stealer, exfiltrating sensitive data including API keys, cloud provider credentials, and Kubernetes secrets. The payload employed AES-256-CBC encryption for data and RSA for key protection, ultimately attempting to establish persistence via a system service and download further payloads from attacker-controlled infrastructure. → sonatype.com |
| 2026-04-19 2026 | LiteLLM PyPI Package Compromised in TeamPCP Supply Chain Attack news 3 min read | Library compromised in a supply-chain attack, where malicious versions of the LiteLLM Python package (1.82.7 and 1.82.8) were uploaded to PyPI by the TeamPCP hacking group. These versions deployed an infostealer that harvested sensitive data including SSH keys, cloud credentials, Kubernetes secrets, and cryptocurrency wallet data. The payload also attempted lateral movement and installed a persistent systemd backdoor, exfiltrating data to attacker-controlled infrastructure. Organizations are advised to rotate credentials and inspect systems for persistence artifacts. → bleepingcomputer.com |
| 2026-04-19 2026 | Malicious PyPI Package — LiteLLM Supply Chain Compromise news 1 min read | Writeup detailing the LiteLLM supply chain compromise, where malicious Python `.pth` files in `site-packages/` automatically execute embedded, double base64-encoded payloads. These payloads exfiltrate environment variables, SSH keys, and cloud credentials to attacker-controlled servers like `models[.]litellm[.]cloud`. The attack, attributed to TeamPCP, exploits versions 1.82.8 and potentially 1.82.7 of LiteLLM, necessitating immediate credential rotation and checks for suspicious `.pth` files. |
| 2026-04-19 2026 | The PyPI Supply Chain Attacks of 2025 news Supply Chain | The PyPI Supply Chain Attacks of 2025 |
| 2026-04-16 2026 | PYPI Security: How to Prevent Supply Chain Attacks in Python Projects beginner | PYPI Security: How to Prevent Supply Chain Attacks in Python Projects |
| 2026-04-16 2026 | Python Tools for Penetration Testers beginner 6 min read | Library offering Python tools for penetration testers, vulnerability researchers, and reverse engineers. It lists libraries and programs for packet manipulation (Scapy, Impacket, dpkt), network reconnaissance (AutoRecon, Mitm6, SMBMap), web application security (XSStrike, Powerfuzzer, waymap), fuzzing (afl-python, Peach Fuzzing Platform), disassembly and emulation (Capstone, Unicorn Engine, Frida, Angr), memory analysis (Volatility, Rekall), and reverse engineering of applications (Androguard, Ghidatron, pefile). |
| 2026-04-16 2026 | Escalating Deserialization Attacks in Python intermediate 7 min read | Library for escalating Python deserialization attacks, demonstrating how insecure deserialization with `pickle` can lead to Remote Code Execution (RCE). The entry details how to exploit Python 2 and Python 3 vulnerabilities using techniques like `__reduce__` methods, `eval`, `compile`, and `exec` to achieve code injection and access sensitive files like `/etc/passwd` without leaving obvious artifacts of direct shell access. |
| 2026-04-16 2026 | Exploiting Python Pickles - David Hamann intermediate 5 min read | Writeup detailing the exploitation of Python's `pickle` module for remote code execution. It explains how the `__reduce__` method can be abused during deserialization to execute arbitrary commands, demonstrating this with a Flask application and a reverse shell payload. The writeup emphasizes the security risks of unpickling untrusted data and suggests alternatives like JSON or data signing. |
| 2026-04-16 2026 | Attack on Software Supply Chains Using Fake Python Infrastructure intermediate 9 min read | Library detailing a sophisticated software supply chain attack where an attacker distributed malware by creating a fake Python infrastructure with a typosquatted domain and a malicious "colorama" package. This campaign affected over 170,000 users, leveraging compromised GitHub accounts and multi-stage execution with obfuscation techniques to steal sensitive data like credentials and session tokens from various applications. → checkmarx.com |
| 2026-04-16 2026 | Defense in Depth: A Practical Guide to Python Supply Chain Security beginner 32 min read | Library for Python supply chain security, detailing defenses against attacks like the Ultralytics compromise. It advocates for layered security, starting with static analysis using Ruff, dependency pinning with cryptographic hashes via uv, and vulnerability scanning with pip-audit. The library also covers generating SBOMs with CycloneDX for rapid impact assessment, and adopting Trusted Publishing with OIDC for secure package distribution, emphasizing that no single control is perfect but multiple layers mitigate risk. |
| 2026-04-16 2026 | How Python Pickle Deserialization Security Exploit Works intermediate 16 min read | Library for understanding Python pickle deserialization exploits, detailing how attackers can achieve arbitrary code execution by crafting malicious pickle payloads, often leveraging the `__reduce__` method for command injection via functions like `os.system`. The resource highlights common attack vectors such as insecure file uploads and vulnerable API endpoints that blindly deserialize untrusted data, leading to real-world impacts like remote code execution and data breaches. |
| 2026-04-16 2026 | Insecure Deserialization in Python: Attack Techniques and Secure Coding intermediate 8 min read | Library for understanding and mitigating insecure deserialization vulnerabilities in Python. It details attack techniques using Python's `pickle`, `PyYAML` (specifically `yaml.load`), `jsonpickle`, `shelve`, and `marshal`. The resource covers how attackers fingerprint applications, craft payloads like reverse shells and OS command injection, and deliver them via HTTP, and includes steps for post-exploitation such as privilege escalation and lateral movement. Secure coding practices, including using `yaml.safe_load`, are also discussed. |
| 2026-04-16 2026 | The Complete Guide on Python for Cyber Security beginner 9 min read | Library for integrating Python into cybersecurity workflows, aiding penetration testers, security analysts, incident responders, researchers, and network security engineers. It leverages Python's readability, extensive libraries like Requests, Scapy, Pandas, PyTorch, pwntools, Atheris, CrowdStrike FalconPy, vt-py, YARA, pySigma, and PyMISP, and its versatility to automate tasks, build exploits, analyze data, detect anomalies, and manage infrastructure, supporting tools like Nmap, Metasploit, and Burp Suite. |
| 2026-04-13 2026 | Critical flaw in Marimo Python notebook exploited within 10 hours of disclosure news 3 min read | Writeup of CVE-2026-39987, a critical pre-authentication RCE vulnerability in Marimo Python notebooks, which allows unauthenticated attackers to gain a full shell and execute arbitrary commands. Exploited within 10 hours of disclosure, this flaw affects Marimo versions prior to 0.23.0 and enables credential theft in under three minutes. The vulnerability stems from an unauthenticated terminal WebSocket endpoint, highlighting risks in AI-adjacent developer tools like MLflow and Langflow. → csoonline.com |
| 2026-04-10 2026 | This Python notebook flaw shows how fast hackers are acting on advisories news | This Python notebook flaw shows how fast hackers are acting on advisories https://ift.tt/U56juBE → cybernews.com |
| 2026-04-10 2026 | Python CVE Details beginner | Python CVE Details |
| 2026-04-10 2026 | Python Security Vulnerabilities CVE Database beginner | Python Security Vulnerabilities CVE Database |
| 2026-04-10 2026 | Picklescan Allows RCE via Malicious Pickle File intermediate 1 min read | Advisory GHSA-655q-fx9r-782v details a remote code execution (RCE) vulnerability in Python's pickle module. Attackers can craft malicious pickle files that bypass static analysis tools like Picklescan by leveraging `pip.main()` for installation of a compromised package. This allows arbitrary code execution during deserialization, impacting systems that process untrusted pickle data and enabling supply chain attacks. |
| 2026-04-10 2026 | CVE-2025-56005: PLY RCE Vulnerability news 4 min read | Library vulnerability analysis of CVE-2025-56005 in Dabeaz PLY version 3.11, detailing an insecure deserialization flaw within an undocumented `picklefile` parameter of the `yacc()` function. This allows Remote Code Execution (RCE) through malicious pickle files, a risk amplified by the parameter's obscurity. The analysis includes technical details on the attack vector, root cause (CWE-502), detection methods, and mitigation strategies, while noting ongoing disputes regarding the CVE's validity. → sentinelone.com |
| 2026-04-10 2026 | Multi-Stage Malware Attack on Python Package Index advanced 4 min read | Tool for verifying Python Package Index (PyPI) dependencies, specifically addressing the chimera-sandbox-extensions malware that harvested developer credentials and environment variables. It emphasizes implementing curated package registries, software composition analysis within CI/CD pipelines, lock file usage, and hash-based verification to prevent supply chain attacks. The tool supports techniques like static and dynamic analysis to detect credential harvesting and DGA calls, alongside runtime sandboxing and secret management to mitigate risks from compromised dependencies. |
| 2026-04-10 2026 | CVE-2025-1716 Sonatype Security Advisory news 2 min read | Advisory detailing CVE-2025-1716, an unsafe deserialization vulnerability in Python's `pickle` module, allowing bypass of static analysis tools like `picklescan`. An attacker can craft a malicious model using `pickle` to execute `pip.main()` and install a compromised PyPI package, leading to remote code execution. The vulnerability, CWE-184, stems from `pip` not being treated as an unsafe global by `picklescan` before version 0.0.21. Sonatype recommends upgrading to version 0.0.22 or higher for mitigation. → sonatype.com |
| 2026-04-10 2026 | Picklescan Fails to Detect Unsafe Globals Advisory intermediate 1 min read | Library advisory details a bypass of Picklescan by an unsafe deserialization vulnerability in Python's pickle module. Attackers can leverage `pip.main()` during unpickling to install a malicious package, achieving remote code execution (RCE) via the package's `setup.py` or entry points. This technique allows for silent exploitation and supply chain attacks, as the use of `pip` may not trigger typical security alerts. |
| 2026-04-10 2026 | CVE-2025-1716: Picklescan Analysis Bypass RCE news 1 min read | Writeup of CVE-2025-1716, detailing an unsafe deserialization vulnerability in Python's pickle module. Attackers can bypass static analysis tools like Picklescan by exploiting `pip.main()` during deserialization, leading to the installation of malicious packages and subsequent remote code execution (RCE). The exploit leverages `pip install` to fetch and run arbitrary code from setup.py or post-install hooks, making it a potent supply chain attack vector. |
| 2026-04-10 2026 | Critical Python PLY Library Vulnerability Enables RCE news 2 min read | Writeup of CVE-2025-56005 in Python PLY, detailing how an undocumented `picklefile` parameter in `ply.yacc.yacc()` allows remote code execution. This vulnerability, discovered by Ahmed Abd, leverages Python's `pickle.load()` to deserialize untrusted `.pkl` files, executing arbitrary code during parser initialization. The exploit involves crafting a malicious pickle payload that runs an OS command via `__reduce__()` when `yacc(picklefile='exploit.pkl', ...)` is invoked. Risk is elevated in environments caching, sharing, or auto-generating parser tables, and mitigation involves avoiding the `picklefile` parameter and treating all pickle files as untrusted. → cyberpress.org |
| 2026-04-10 2026 | CVE-2025-56005: Python PLY Flaw Enables Remote Code Execution news 3 min read | Library for hardening Python applications against the CVE-2025-56005 remote code execution vulnerability in the PLY (Python Lex-Yacc) library. This flaw exploits unsafe pickle deserialization when loading cached parser tables via the undocumented `picklefile` parameter, allowing arbitrary code execution during application startup before traditional security controls are active. The library addresses this by promoting secure deserialization practices, filesystem hardening for parser cache locations, and pipeline protections to prevent artifact poisoning. → esecurityplanet.com |
| 2026-04-10 2026 | CVE Search: Python beginner | CVE Search: Python |
| 2026-04-10 2026 | Python CVE Details beginner | Python CVE Details |
| 2026-04-10 2026 | Python Security Vulnerabilities & Risk Score beginner | Library providing a comprehensive security risk assessment for Python, analyzing 349 vulnerabilities with EPSS scores, exploitation status, and remediation availability. It identifies specific weaknesses like `shutil.unpack_archive()` handling of Windows absolute paths, `BaseCookie.js_output()` character neutralization, and out-of-bounds writes in `asyncio.ProacterEventLoop.sock_recvfrom_into()`. The data includes CVEs such as CVE-2026-5713 for mote debugging, CVE-2026-4786 for command injection via `webbrowser.open()`, CVE-2026-6100 for use-after-free in decompression, and CVE-2026-1502 for HTTP client proxy tunnel validation issues, alongside Pillow's vulnerability to FITS GZIP decompression bombs. |
| 2026-04-10 2026 | Python Security Vulnerabilities in 2026 beginner 19 min read | Survey of Python security vulnerabilities impacting versions up to 3.15.0, detailing CVEs such as CVE-2026-6019 (XSS via Morsel.js_output), CVE-2026-3298 (OOB Buffer Write in ProactorEventLoop), and CVE-2026-5713 (Privileged Memory Access via Profiling/Asyncio Introspection). The analysis also highlights issues like command injection in webbrowser.open (CVE-2026-4786), CRLF injection in http.client, and quadratic complexity DoS vulnerabilities in xml.dom.minidom and HTMLParser. The resource also touches upon resource exhaustion in plistlib and various tarfile module vulnerabilities including filter bypass, arbitrary filesystem writes, and infinite loops. |
| 2026-04-10 2026 | RCE With Modern AI/ML Formats and Python Libraries intermediate 13 min read | Library vulnerabilities in NVIDIA's NeMo, Salesforce's Uni2TS, and Apple/ETH Zurich's FlexTok allow for remote code execution (RCE) when malicious metadata is loaded. These PyTorch-based AI/ML libraries, widely used on HuggingFace, leverage Hydra's `instantiate()` function to load configurations, inadvertently executing arbitrary code embedded in metadata. CVE-2025-23304 (NeMo) and CVE-2026-22584 (Uni2TS) have been assigned, with fixes released by the respective vendors. → unit42.paloaltonetworks.com |
| 2026-04-10 2026 | Critical PickleScan Vulnerabilities Expose AI Model Supply Chains news 1 min read | Writeup of CVE-2025-10155, CVE-2025-10156, and CVE-2025-10157, three critical vulnerabilities in PickleScan. These flaws enable attackers to bypass model scanning safeguards and distribute malicious AI models by exploiting file extension misclassifications, divergent ZIP archive handling between PickleScan and PyTorch, and evasion of dangerous import blacklisting through subclassing. The vulnerabilities, with a CVSS score of 9.3, underscore risks in AI supply chains and highlight the need for layered defenses and safer formats like Safetensors. → infosecurity-magazine.com |
| 2026-04-10 2026 | How a Poisoned Security Scanner Backdoored LiteLLM intermediate 9 min read | Library that suffered a supply chain attack via Trivy and Checkmarx KICS, resulting in malicious versions (1.82.7 and 1.82.8) of the litellm Python package being published to PyPI. The attack involved credential harvesting through a compromised GitHub Action and the use of .pth files for persistence, enabling data exfiltration and lateral movement within Kubernetes environments. → snyk.io |
| 2026-04-06 2026 | Rapid Exploitation and Clever Malware in the Supply Chain — Last Week in AppSec news 4 min read | Survey of recent supply chain attacks, including the Langflow code injection vulnerability (CVE-2026-33017) added to the CISA KEV database and the Telnyx Python framework compromise. The Telnyx attack leveraged .wav audio files to conceal malicious payloads that harvested and exfiltrated information. The article also references a JFrog technical analysis of the Telnyx malware. → checkmarx.com |
| 2026-04-06 2026 | CrewAI contains multiple vulnerabilities including SSRF, RCE intermediate 3 min read SSRF | Vulnerabilities in CrewAI include CVE-2026-2275 (RCE via Code Interpreter Tool fallback), CVE-2026-2286 (SSRF via RAG search), CVE-2026-2287 (RCE via Docker fallback), and CVE-2026-2285 (arbitrary file read via JSON loader). Attackers can chain these, exploiting prompt injection to achieve RCE, arbitrary file reads, and SSRF, potentially leading to credential theft or further system compromise. Mitigation involves restricting the Code Interpreter Tool, avoiding `allow_code_execution=True`, sanitizing input, and monitoring Docker status. |
| 2026-04-06 2026 | CVE-2026-33873: Langflow Agentic Assistant RCE Vulnerability news 4 min read | Analysis of CVE-2026-33873 in Langflow details a critical code injection vulnerability (CWE-94) in the Agentic Assistant feature. Versions prior to 1.9.0 incorrectly execute LLM-generated Python code during validation, allowing attackers to achieve arbitrary server-side Python execution by manipulating AI output. This network-accessible vulnerability requires low privileges and can lead to system compromise. Mitigation involves upgrading to Langflow 1.9.0 or later, or disabling the Agentic Assistant feature. → sentinelone.com |
| 2026-04-06 2026 | CVE-2026-34519: AIOHTTP XSS Vulnerability news 4 min read | Library for detecting and mitigating CVE-2026-34519, an HTTP Response Splitting vulnerability in AIOHTTP versions prior to 3.13.4. This flaw, classified as CWE-113, allows attackers to inject arbitrary HTTP headers by controlling the `reason` parameter in `Response` objects, potentially leading to cache poisoning or cross-site scripting. The library assists in identifying affected applications and provides mitigation strategies, including upgrading AIOHTTP, input sanitization for CRLF characters, and WAF rule implementation. → sentinelone.com |
| 2026-04-05 2026 | Known Unpatched Exploitable: Redashs Python Sandbox Escape Gives Attackers Full Server Access news 3 min read | Writeup of a Redash sandbox escape vulnerability, exploitable via the Python data source, allowing remote code execution and full server compromise. OX Research discovered that an insecure reassignment of Python's `getattr` function within the sandbox context enables attackers to access and execute arbitrary system commands, leading to potential data exposure and lateral movement. All Redash versions with the Python data source enabled are affected, with no patch currently available. → ox.security |
| 2026-04-03 2026 | A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI advanced | A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI → arxiv.org |
| 2026-04-03 2026 | Exposing 4 Critical Vulnerabilities in Python PickleScan | Sonatype news 5 min read Deser | Writeup of four critical vulnerabilities discovered in the Python security tool picklescan. CVE-2025-1716 allows arbitrary code execution, bypassing static analysis. CVE-2025-1889 fails to detect hidden files relying on extensions. CVE-2025-1944 is vulnerable to ZIP filename tampering, causing crashes but allowing model loading. CVE-2025-1945 fails to detect malicious files when ZIP file flag bits are modified. These issues impact AI/ML model security and were addressed in picklescan version 0.0.23. → sonatype.com |
| 2026-04-03 2026 | Python SAST Tools: Free & Paid Solutions for Secure Code Analysis beginner 4 min read | Library providing Static Application Security Testing (SAST) for Python, employing lexical, control flow, data flow, and semantic analysis to detect vulnerabilities. It details open-source tools like Bandit and Semgrep, and commercial solutions such as Checkmarx, Veracode, GitHub Advanced Security, and GitLab SAST. The library emphasizes IDE plugin and CI/CD integration for "Shift Left Security" practices, enabling early detection and remediation of issues like injection flaws and hard-coded secrets. |
| 2026-04-03 2026 | 10 Common Security Gotchas in Python and How to Avoid Them beginner | 10 Common Security Gotchas in Python and How to Avoid Them |
| 2026-04-03 2026 | Insecure Deserialization in Python | Semgrep intermediate 5 min read | Library for detecting insecure deserialization vulnerabilities in Python code, focusing on the dangers of libraries like `pickle`, `dill`, `jsonpickle`, and `shelve` when processing untrusted input. It highlights how these libraries can lead to remote code execution and provides examples of exploitation, including a demonstration with `pickle.dumps` and `os.system`. The library's rules identify data flow from untrusted sources to sensitive deserialization functions, offering practical recommendations to avoid risks such as avoiding `pickle` for untrusted data, using safer alternatives like JSON or `PyYAML`'s `safe_load`, and integrating Semgrep scans into CI pipelines. Specific mitigations for Django, NumPy, and PyTorch are also mentioned. |
| 2026-04-03 2026 | PyTorch Users at Risk: 3 Zero-Day PickleScan Vulnerabilities | JFrog news 11 min read Deser | Library for detecting vulnerabilities in PyTorch models. JFrog Security Research discovered three zero-day vulnerabilities in PickleScan, the industry-standard tool for scanning pickle-based models. These bypasses, including CVE-2025-10155, allow attackers to embed undetected malicious code within PyTorch models, leading to potential supply chain attacks. PickleScan's reliance on file extension checks over content analysis, and its blacklist approach, create these exploitable gaps. → jfrog.com |
| 2026-04-03 2026 | PickleScan - Security Scanner Detecting Suspicious Python Pickle Files beginner 2 min read | Tool for scanning Python Pickle files for malicious code execution. PickleScan detects dangerous global imports like `eval()` within pickle data, supporting analysis of local files, directories, URLs, and Hugging Face models. It offers filtering capabilities for directory scans and exit codes similar to ClamAV. The tool draws upon research from various security experts and events, including discussions on backdooring pickle files and arbitrary code execution vulnerabilities. |
| 2026-04-03 2026 | Python Secure Coding Guidelines beginner | Python Secure Coding Guidelines |
| 2026-04-03 2026 | Bandit: Python Static Application Security Testing Guide beginner 3 min read | Library for static analysis of Python code, Bandit identifies security vulnerabilities like insecure cryptography (B303, B304), use of `assert` (B101), `eval`/`exec` (B102, B307), hardcoded secrets (B105), `pickle` (B301), and `subprocess` issues (B602). It integrates into development workflows and CI/CD pipelines, generating detailed reports for remediation. Complementary tools include Safety and pytest. |
| 2026-04-03 2026 | Python Security Vulnerabilities | Top Issues | Aikido beginner 25 min read | Library for identifying and mitigating common Python security vulnerabilities. It details risks like arbitrary code execution via `eval()` and `exec()`, OS command injection through `subprocess` and `os.system`, and the dangers of hardcoded secrets. The library emphasizes practical mitigation techniques, such as avoiding unsafe function usage, using argument lists with `subprocess`, and employing secure secret management practices. It highlights how SAST tools can detect these patterns early in development. → aikido.dev |
| 2026-03-03 2026 | Show HN: Drawbridge – Drop-In SSRF Protection for Python | Hacker News intermediate SSRF | Library for drop-in SSRF protection for Python applications, replacing `requests` or `httpx`. Drawbridge resolves DNS, validates all IPs against private/reserved ranges, pins connections by rewriting URLs to validated IPs, and re-validates on redirects. This method effectively blocks DNS rebinding, address obfuscation, and redirect-based SSRF attacks. |
| 2026-01-17 2026 | pwviptbl/ProxyHunter: Aplicação Python com interface gráfica que permite configurar regras de interceptação para modificar parâmetros de requisições HTTP. Quando o navegador envia uma requisição para uma rota configurada, o proxy intercepta, modifica apenas os parâmetros especificados e encaminha a requisição mantendo todos os outros parâmetros originais. intermediate 12 min read API Sec Burp | Tool that intercepts HTTP requests to modify specific parameters. ProxyHunter is a Python application with a graphical interface that allows users to configure interception rules for HTTP requests. It intercepts requests to configured routes, modifies only specified parameters, and forwards the request while preserving all other original parameters. Features include a GUI, multiple rule configuration, GET and POST support, individual rule activation/deactivation, JSON persistence, configurable port, manual interception, WebSocket support, an advanced Intruder, and a vulnerability scanner detecting SQL Injection, XSS, CSRF, Path Traversal, and exposed sensitive information. |
| 2026-01-12 2026 | dr34mhacks/jwtauditor: JWT Auditor – Analyze, break, and understand your tokens like a pro. intermediate 3 min read JWT | Library for comprehensive JWT security testing, enabling penetration testers to decode, analyze, and exploit tokens. It features automated vulnerability detection for 15+ types, including algorithm confusion attacks, KID parameter injection, and JKU/X5U manipulation. JWTAuditor also supports secret bruteforcing, token editing, and generation, with all processing handled client-side for privacy. It includes built-in wordlists and custom support, detailed explanations for findings, and guides on JWT fundamentals and attack techniques. |
| 2025-12-24 2025 | yo-yo-yo-jbo/python_for_researchers: Python for offensive security research beginner 11 min read | Library for offensive security researchers demonstrating advanced Python techniques. It details how to execute Python code from C using dynamic library loading of `libpythonX.Y.so`, leveraging functions like `Py_Initialize` and `PyRun_SimpleString`. Conversely, it explores using Python's `ctypes` module for low-level Windows API interactions, such as implementing a DLL injector by calling `CreateToolhelp32Snapshot`, `OpenProcess`, `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`. |
| 2025-12-03 2025 | 30 low-high level honeypots in a single PyPI package beginner Supply Chain | https://t.co/sH0hx43Dcp |
| 2025-11-09 2025 | Exploring HTTPS With Python beginner 36 min read | Tutorial on building Python HTTPS applications, covering HTTP fundamentals, the role of TLS/SSL in securing communications, analyzing network traffic, applying cryptography, and understanding Public Key Infrastructure (PKI). It guides users through creating their own Certificate Authority and building a secure Python HTTPS server using Flask, including identifying common warnings and errors. → realpython.com |
| 2025-10-12 2025 | I Tried Automating My Entire Browser with Python — Now I Barely Click Anything intermediate | I Tried Automating My Entire Browser with Python — Now I Barely Click Anything How Selenium, Playwright, and a few tricks turned me into a lazy automation wizard 1. I Was Tired of Logging In 10 … |
| 2025-10-12 2025 | How I Built 6 Micro-Tools in Python That Earn Me Passive Income Daily beginner | How I Built 6 Micro-Tools in Python That Earn Me Passive Income Daily I stopped chasing big projects and started building tiny, high-impact Python scripts. These libraries helped me automate, scale … → python.plainenglish.io |
| 2025-08-14 2025 | Writing API exploits in Python intermediate 7 min read | Library for generating Python API exploit proof-of-concepts, focusing on BOLA vulnerabilities within the crAPI project. It demonstrates converting requests captured in Burp Suite's Repeater or Intruder into executable Python code using the `curlconverter` tool. The process involves cleaning up `curl` commands, transpiling them to Python, and then refining the generated code for better usability, incorporating features like argument parsing for target URLs and report IDs. → danaepp.com |
| 2025-08-14 2025 | GitHub - paulpierre/markdown-crawler: A multithreaded ?️ web crawler that r intermediate 4 min read | Tool for multithreaded web crawling that converts pages into markdown files. Primarily designed for large language model document parsing, simplifying RAG and LLM fine-tuning use cases by normalizing large documents. Features include threading, resuming crawls, configurable depth, and support for tables and images. It utilizes BeautifulSoup for HTML parsing and offers a CLI interface for direct use. |
| 2025-08-14 2025 | GitHub - Fadi002/de4py: toolkit for python reverse engineering intermediate 2 min read | Library for Python reverse engineering; de4py offers automatic and manual deobfuscation tools with a PySide6 UI. It supports common packers and integrates with local LLMs via Ollama for AI-assisted deobfuscation of heavily obfuscated code, utilizing models like qwen2.5-coder:1.5b. The toolkit is structured with core logic, deobfuscator engines, a user interface, and utilities, and is available under a non-commercial license. |
| 2025-08-14 2025 | How to store your users' API keys securely in Django ? intermediate 2 min read | Library for securely encrypting and storing user API keys in Django applications. This solution involves generating a Fernet encryption key, storing it in environment variables, and creating a Django model to manage encrypted keys. The guide details setup, model creation, frontend development with forms and views, template integration, and final deployment steps, offering an alternative of offloading encryption to services like AWS KMS. |
| 2025-08-14 2025 | Let’s create a Python Debugger together: Part 1 | Mostly nerdless intermediate 10 min read | Library implementing a Python debugger from scratch, starting with a `breakpoint()` function-based version. This library allows users to set breakpoints, inspect local variables using `sys._getframe()`, and execute arbitrary Python code within the context of the interrupted function. It extends the built-in `pdb` functionality by providing a simplified interface for debugging Python scripts. |
| 2025-08-14 2025 | The easy way to concurrency and parallelism with Python stdlib beginner 9 min read | Library utilizing Python's standard library `concurrent.futures` module, specifically `ThreadPoolExecutor` and `ProcessPoolExecutor`, for simplified concurrency and parallelism. This resource demonstrates how to effectively manage tasks like web scraping or file operations without the complexity often associated with these concepts, providing concrete examples of code implementation. |
| 2025-08-14 2025 | Pygoat - Learn Django security the hard way - Speaker Deck beginner 9 min read Bug Bounty | Library for learning Django security by attacking and securing Pygoat, an intentionally vulnerable Python application. It covers OWASP Top 10 vulnerabilities like Sensitive Data Exposure (CWE-259, CWE-327, CWE-331) and Injection flaws (SQL, NoSQL, OS command, ORM, LDAP, EL/OGNL), offering mitigation strategies such as proper access control, input validation, parameterized queries, and disabling debug modes. The resource also emphasizes secure design patterns, threat modeling, and maintaining up-to-date software components. |
| 2025-08-14 2025 | Click and Python: Build Extensible and Composable CLI Apps – Real Python beginner 48 min read | Library for building extensible and composable Python command-line interfaces. It offers a more flexible and intuitive alternative to `argparse`, leveraging decorators to easily add arguments, options, and subcommands. Click handles type-aware input processing and automatically generates usage and help pages, streamlining CLI development. → realpython.com |
| 2025-08-14 2025 | Asyncio, twisted, tornado, gevent walk into a bar... beginner 18 min read | Library for asynchronous I/O in Python, featuring frameworks like asyncio, twisted, tornado, and gevent. These tools manage concurrent network operations efficiently by allowing other program parts to execute while waiting for external responses, significantly speeding up tasks such as web crawling or server operations. The library demonstrates this with an example fetching titles from multiple URLs, showing dramatic performance improvements over synchronous methods. |
| 2025-08-14 2025 | How to Launch an HTTP Server in One Line of Python Code – Real Python beginner 27 min read | Library for launching a basic HTTP server with a single Python command. Utilize the `http.server` module to serve static files from any directory, specifying ports like 8000 or 8080, and binding to specific interfaces with the `-b` option. Restrict access by binding to `127.0.0.42` or use administrative privileges with `sudo` to serve on port 80. The `-d` option allows serving content from an alternative directory, bypassing potential import conflicts. → realpython.com |
| 2025-08-14 2025 | https://www.codelivly.com/building-a-vulnerability-scanner-using-python/ intermediate 7 min read | Library for building a vulnerability scanner in Python, this resource details a process that begins with converting a port scanner into a class. The script then prompts for target IP, port range, and a file listing known vulnerable software banners. It scans for open ports, retrieves service banners, and compares them against the provided vulnerability list to identify and report exploitable services. |
| 2025-08-14 2025 | Build an Arp Spoofer From Scratch | by Rahul Kumar | Jan, 2023 | System Wea intermediate | The content appears to be about creating an ARP spoofer from scratch, authored by Rahul Kumar in January 2023. ARP spoofing is a technique used for network manipulation by sending false Address Resolution Protocol (ARP) messages. The article likely provides instructions or insights on how to build this tool independently. |
| 2025-08-14 2025 | Creating an Advanced Network Packet Sniffer in Python: A Step-by-Step Guide intermediate | The content is a guide on building an advanced network packet sniffer using Python. It likely provides a detailed, step-by-step approach to creating a tool that can intercept and log network traffic for analysis or monitoring purposes. The guide may cover topics such as capturing packets, analyzing their contents, and potentially implementing additional features to enhance the functionality of the packet sniffer. Overall, it aims to help readers understand the process of developing a network packet sniffer using Python. |
| 2025-08-14 2025 | Python Simple HTTP Server With SSL Certificate (Encrypted Traffic) | Python intermediate | The content appears to be about setting up a Python Simple HTTP Server with an SSL certificate to enable encrypted traffic. This setup allows for secure communication over the network by encrypting data exchanged between the server and clients. The use of SSL certificates ensures that the data transmitted is protected from unauthorized access or interception. This setup is beneficial for enhancing the security of web applications or services that require secure communication protocols. → python.plainenglish.io |
| 2025-08-14 2025 | Python Decorators (made easy). Decorator can be used to send function… | by beginner | The content seems to be about Python decorators, which are used to modify or extend the behavior of functions in Python. Decorators are a powerful tool that can be used to add functionality to existing functions without modifying their code. They are commonly used for tasks like logging, authentication, and performance monitoring. Decorators are a key feature in Python that allows for cleaner and more modular code. |
| 2025-08-14 2025 | Python Requests Library Caused a Production Outage | by Daryan Hanshew | Ju news | The Python Requests library caused a production outage, as reported by Daryan Hanshew. The incident likely involved issues or errors related to the use of the Python Requests library, impacting the production environment. Further details or insights about the outage, its causes, and potential solutions are not provided in the summary. |
| 2025-08-14 2025 | https://github.com/microsoft/picologging beginner 3 min read | Library for high-performance Python logging, picologging offers a drop-in replacement for the standard library's `logging` module, boasting 4-17x speed improvements. It maintains API compatibility, allowing seamless integration into existing applications. Installation is available via pip or conda, and developers can utilize its CPython 3.11 components for enhanced compatibility and debugging capabilities. |
| 2025-08-14 2025 | TryHackMe | Python Basics. In this story I will be sharing my… | by Mukkara beginner | The content appears to be about a story shared by Mukkara on TryHackMe regarding Python basics. The story likely includes insights, experiences, or tutorials related to Python programming fundamentals. Mukkara may be sharing tips, tricks, or lessons learned while exploring Python basics on the TryHackMe platform. The content seems to focus on practical applications or explanations of Python concepts for beginners or those interested in learning more about Python programming. |
| 2025-08-14 2025 | 6 Python Libraries For Cyber Security Professionals and Ethical Hackers | b beginner | The content mentions 6 Python libraries useful for cyber security professionals and ethical hackers. These libraries likely provide tools and functions that can assist in tasks related to cybersecurity, such as threat detection, vulnerability analysis, or penetration testing. Python is a popular programming language in the cybersecurity field due to its versatility and ease of use for developing security tools and scripts. The libraries mentioned may offer pre-built functionalities that can streamline and enhance the work of professionals in the cybersecurity and ethical hacking domains. → python.plainenglish.io |
| 2025-08-14 2025 | RegEx in Python: Introduction and The use of Backslash | by Manash Bhele | beginner | The content titled "RegEx in Python: Introduction and The use of Backslash" by Manash Bhele likely discusses regular expressions (RegEx) in Python, introducing the concept and focusing on the use of the backslash (\) character within regular expressions. The article may delve into how backslashes are utilized in Python's RegEx to escape special characters or create specific patterns for matching text. It is a beginner-friendly guide that aims to explain the basics of using RegEx in Python with a particular emphasis on understanding and applying the backslash in regular expressions. |
| 2025-08-14 2025 | https://www.thepythoncode.com/article/create-reverse-shell-python intermediate 6 min read | Library for creating reverse shells in Python. This resource details the implementation of both server (attacker) and client (target) code, enabling remote execution of system commands like `cmd.exe` or `bash/zsh` and bypassing firewalls by initiating connections from the target to the attacker. It covers socket programming, command execution via `subprocess`, directory traversal with `os.chdir`, and message passing with a custom separator. |
| 2025-08-14 2025 | (304) Remote Procedural Call via XML-RPC in 5 minutes - YouTube beginner | The content is a video tutorial on YouTube titled "(304) Remote Procedural Call via XML-RPC in 5 minutes." It likely provides a quick guide or demonstration on how to perform remote procedural calls using XML-RPC within a short timeframe. The video may offer step-by-step instructions or examples to help viewers understand and implement XML-RPC for remote communication. |
| 2025-08-14 2025 | A Python prompt into a running process: debugging with Manhole intermediate 4 min read | Library for live debugging of running Python processes. Manhole enables an interactive Python prompt attached to a live process, allowing inspection of variables and state. It uses Unix domain sockets and can be accessed via tools like `socat`. While useful for diagnosing unexpected behavior, its use in production carries risks of unintended modifications and highlights a need for robust logging and monitoring. The library supports exposing specific objects or using the garbage collector to access program state. |
| 2025-08-14 2025 | Python monkey-patching like a boss | by Sergei | Medium intermediate | The content appears to be about monkey-patching in Python, a technique that allows developers to dynamically modify or extend the behavior of classes or modules at runtime. Monkey-patching can be a powerful tool when used carefully, but it can also lead to unexpected behavior and should be approached with caution. The article likely discusses best practices, examples, and considerations for effectively implementing monkey-patching in Python. |
| 2025-08-14 2025 | https://github.com/pikepdf/pikepdf beginner 4 min read | Library for reading, writing, repairing, and transforming PDFs in Python. Built on the qpdf C++ library, pikepdf offers automatic PDF repair, XMP metadata editing, robust encryption support (AES-256, AES-128, RC4), and linearization for fast web viewing. It provides a Pythonic API for low-level manipulation and object access, along with lossless image extraction and Jupyter integration. Binary wheels are available for all major platforms, simplifying installation. |
| 2025-05-24 2025 | Django Security Best Practices: A Comprehensive Guide for Software Engineers - Corgea - Home beginner 5 min read | Library for hardening Django applications, detailing best practices against threats like XSS, SQL injection, and CSRF. It covers updating Django versions, enabling HTTPS with `SECURE_SSL_REDIRECT`, using strong `SECRET_KEY` management, securing databases, and leveraging Django's built-in features like `SecurityMiddleware`, Content Security Policy via `django-csp`, and `X_FRAME_OPTIONS`. The resource also addresses authentication hardening with `AUTH_PASSWORD_VALIDATORS` and packages like `django-otp`, dependency auditing using `pip-audit`, and comprehensive logging. |
| 2025-05-07 2025 | Using JWTs in Python Flask REST Framework | AppSignal Blog intermediate 8 min read API Sec AuthN | Library implementing JSON Web Tokens (JWTs) for secure authentication in Python Flask REST frameworks. It details JWT structure (header, payload, signature), benefits like stateless sessions and efficiency, and provides practical examples for user registration, login, token creation using `Flask-JWT-Extended`, and securing API endpoints with `@jwt_required()`. The entry also covers implementing refresh tokens for longer sessions and managing token expiration. |
| 2025-03-01 2025 | GitHub - roshanlam/Spider: Web Crawler built using asynchronous Python and distributed task management that extracts and saves web data for analysis. beginner 4 min read | Library for asynchronous, distributed web crawling and data extraction. It leverages aiohttp, asyncio, Celery, Redis, and PostgreSQL to manage tasks, store data, and process information. Features include a plugin architecture for custom logic, comprehensive webpage data extraction (metadata, content, links, forms, social metadata), NLP-based entity recognition with spaCy, and JavaScript rendering support via Playwright. The library allows for scalable crawling, real-time metrics, and robust logging. |
| 2025-01-14 2025 | Build Your Web Scraper with Crawlbase in Python: A Beginner’s Guide beginner | Learn how to build your first web scraper in Python using Crawlbase. This beginner-friendly guide covers web scraping essentials, bypassing |
| 2024-12-31 2024 | GitHub - danialhalo/SqliSniper: Advanced Time-based Blind SQL Injection fuzzer for HTTP Headers advanced 3 min read Fuzzing SQLi | Tool for advanced time-based blind SQL injection fuzzing in HTTP headers. SqliSniper utilizes multi-threaded scanning for efficiency and employs response time analysis to reduce false positives. It supports custom payloads and headers, and can send alerts to Discord webhooks upon detecting vulnerabilities. The tool can scan single URLs, lists of URLs from a file, or process piped input from other security tools. |
| 2024-12-29 2024 | Python for Dark Web OSINT: Automate Threat Monitoring intermediate OSINT | Learn how to use Python to automate monitoring of dark web forums, leak sites, and marketplaces for actionable threat intelligence. |
| 2024-12-20 2024 | GitHub - xnl-h4ck3r/knoxnl: This is a python wrapper around the amazing KNOXSS API by Brute Logic intermediate 8 min read API Sec | Library for interacting with the KNOXSS API, enabling automated scanning for XSS and Open Redirect vulnerabilities. This Python wrapper supports various input methods, including single URLs and files, and allows for custom configurations for API keys, Discord webhooks, and output formats. It integrates with Burp Suite via the Piper extension, facilitating in-proxy security testing. The library respects KNOXSS API rate limits and offers features like Flash Mode for quick polyglot tests and handling of POST requests. |
| 2024-12-19 2024 | GitHub - WafflesExploits/hide-payload-in-images: A project that demonstrates embedding shellcode payloads into image files (like PNGs) using Python and extracting them using C/C++. Payloads can be retrieved directly from the file on disk or from the image stored in a binary's resources section (.rsrc) advanced 1 min read RCE | Library for embedding and extracting shellcode payloads within image files like PNGs. Utilizes Python for embedding and C/C++ for extraction, supporting retrieval from disk or a binary's `.rsrc` section. Includes stealthy extraction via manual PE header parsing and PEB access, avoiding WinAPI calls for enhanced evasion. Supports both executable and DLL builds with improved PEB structure definitions for portability. |
| 2024-12-12 2024 | GitHub - mherrmann/helium: Lighter web automation with Python beginner 4 min read | Library for lighter web automation in Python, Helium offers a high-level API that simplifies tasks compared to Selenium. It allows referencing elements by user-visible labels, resulting in shorter and more stable scripts. Helium also streamlines interaction with iframes, window management, and provides built-in implicit and explicit waits, eliminating the need for complex `WebDriverWait` calls. The library is sponsored by RapidProxy and can be installed via pip. |
| 2024-12-11 2024 | GitHub - apify/crawlee-python: Crawlee—A web scraping and browser automation library for Python to build reliable crawlers. Extract data for AI, LLMs, RAG, or GPTs. Download HTML, PDF, JPG, PNG, and other files from websites. Works with BeautifulSoup, Playwright, and raw HTTP. Both headful and headless mode. With proxy rotation. beginner 5 min read | Library for building reliable web scrapers and crawlers in Python. It offers a unified interface for both HTTP and headless browser crawling, supporting BeautifulSoupCrawler for HTML parsing and PlaywrightCrawler for JavaScript-heavy sites. Key features include automatic retries, proxy rotation, configurable request routing, persistent queues, and pluggable storage for extracted data and files. Crawlee leverages asyncio for performance and integrates seamlessly with other asynchronous Python libraries. |
| 2024-11-29 2024 | Python Twisted proxy - how to intercept packets intermediate Burp | Library for intercepting and modifying HTTP request and response bodies using Python's Twisted framework. Demonstrates a basic proxy setup using `twisted.web.proxy` and `twisted.internet.reactor`, enabling developers to inspect and alter data as it flows through the proxy. The provided code snippet serves as a starting point for building custom HTTP proxy functionalities. → stackoverflow.com |
| 2024-10-30 2024 | Flask & Pydantic: Streamline Python APIs with Seamless Data Validation intermediate | This guide explores the seamless integration of Flask, a popular web framework, with Pydantic, a powerful data validation library. |
| 2024-10-30 2024 | SSH Scripting with Fabric and Python - Mouse Vs Python beginner 3 min read | Library for executing shell commands remotely over SSH using Python. This resource demonstrates using Fabric 3.2.2 to connect to servers, run commands with or without `sudo`, and transfer files using `put()` and `get()` methods, including uploading to restricted directories via a two-step `put()` and `sudo()` process. |
| 2024-10-24 2024 | Cryptography — The Hitchhiker's Guide to Python beginner 2 min read Secrets | Library for Python cryptography, offering both high-level symmetric encryption with Fernet and low-level primitives via the `cryptography` package. It also provides GPGME Python bindings, enabling interaction with the GNU Privacy Guard suite for encryption, decryption, and signing operations, supporting Python 2.6+ and 3.3+. |
| 2024-10-17 2024 | GitHub - cle-b/httpdbg: A tool for Python developers to easily debug the HTTP(S) client requests in a Python program. intermediate 4 min read | Tool for Python developers to debug HTTP(S) client and server requests. Executing programs via `pyhttpdbg` instead of `python` enables inspection of requests in a web browser at `http://localhost:4909`. Supports HTTP/1.0, HTTP/1.1, and HTTP/2. It can trace requests made by scripts, modules (like `pip`), and tests (`pytest`, `unittest`), and can record requests received by HTTP servers. The tool allows grouping requests by test and offers customization options for the web interface. |
| 2024-10-01 2024 | GitHub - bl4de/security-tools: My collection of various security tools created mostly in Python and Bash. For CTFs and Bug Bounty. intermediate Bug Bounty | My collection of various security tools created mostly in Python and Bash. For CTFs and Bug Bounty. - bl4de/security-tools |
| 2024-09-23 2024 | Let’s build and optimize a Rust extension for Python intermediate 9 min read | Library for optimizing Python performance by building Rust extensions. This resource details how to create a Rust extension for Python using tools like PyO3 and Maturin. It contrasts a memory-intensive exact unique value count with a probabilistic approach, then demonstrates reimplementing the probabilistic algorithm in Rust to achieve significant speed improvements over the pure Python version, showcasing techniques for efficient data handling and integration with Python objects. |
| 2024-08-28 2024 | GitHub - mkalioby/django-mfa2: A Django app that handles MFA, it supports TOTP, U2F, FIDO2 U2F (Webauthn), Email Token and Trusted Devices intermediate 5 min read AuthN | Library providing multi-factor authentication (MFA) for Django applications. It supports TOTP, U2F, FIDO2 (WebAuthn) with various authenticators like security keys and Windows Hello, Email Tokens, and Trusted Devices. The library allows for customizable settings, integration with existing login flows, and offers passwordless login capabilities. |
| 2024-08-21 2024 | 17 Mindblowing Python Automation Scripts I Use Everyday beginner | Scripts That Increased My Productivity and Performance |
| 2024-08-17 2024 | GitHub - wapiti-scanner/wapiti: Web vulnerability scanner written in Python3 intermediate 5 min read | Library for "black-box" web vulnerability scanning, Wapiti leverages Python 3.12-3.14 to act as a fuzzer, discovering vulnerabilities by sending payloads to web applications and analyzing responses. It supports various attack modules, including SQL Injections, XSS, File Disclosure, Command Execution, XXE, Shellshock, and Log4Shell (CVE-2021-44228), Spring4Shell (CVE-2020-5398), and can generate reports in multiple formats. Wapiti offers features like scan suspension, session management, proxy support, and the ability to import cookies from browsers. |
| 2024-08-02 2024 | GitHub - SpaceWolfWasTaken/httpy: A barebones HTTP server created from raw python sockets. intermediate | A barebones HTTP server created from raw python sockets. - SpaceWolfWasTaken/httpy |
| 2024-07-26 2024 | Release v0.3.0 · joaovitoriasilva/endurain news 1 min read AuthN | Library release v0.3.0 for endurain, a Python application security library, introduces OAuth scopes, multi-client support (web and mobile), PWA support, theme and language switchers, and dependency management with poetry. This update also includes significant backend changes to password hashing, requiring automatic migration for admin accounts. Frontend improvements focus on UI fixes and pagination, while general updates include multi-arch Docker images and documentation enhancements. Users should back up their database before updating due to schema changes. |
| 2024-07-23 2024 | Isolating risk in the CPython release process advanced 3 min read | Analysis of CPython's release process improvements, funded by Alpha-Omega, detailing the isolation of source artifact builds using GitHub Actions. This change significantly reduces the dependency footprint for critical build stages, decreasing supply chain risk by separating source artifact generation from documentation builds and testing, with the "Build Source" task now requiring approximately 170 dependencies instead of over 800. |
| 2023-12-18 2023 | Python Asyncio and Footguns intermediate | The content discusses the potential dangers of using Python's Asyncio module, referred to as "footguns," which are pitfalls that can lead to unintended consequences in asynchronous programming. It emphasizes the importance of understanding Asyncio's complexities to avoid common mistakes that can impact performance and reliability. The article likely provides insights on best practices, common pitfalls, and tips for effectively utilizing Asyncio in Python programming to maximize its benefits while minimizing risks. |
| 2023-12-10 2023 | timo-reymann/python-oauth2-cli-auth intermediate 1 min read | Library for simplifying OAuth2 authentication in Python CLIs, supporting OIDC providers like gitlab.com and manual configuration. It offers a straightforward method for obtaining access tokens without external dependencies, facilitating integrations with services requiring OAuth2 authorization. The project encourages community contributions for bug reporting, feature proposals, and code fixes. |
| 2023-11-09 2023 | How to Download Files From URLs With Python beginner 22 min read | Tutorial on downloading files from URLs using Python, covering the built-in `urllib` module and the popular `requests` library. It demonstrates using `urlretrieve()` for simple downloads and `requests.get()` for more advanced interactions. The guide also touches on efficient handling of large files through streaming, parallel downloads with `ThreadPoolExecutor` and `aiohttp`, and extracting metadata from HTTP headers for downloaded content, like the `Content-Type` and `Content-Length` of a World Bank CSV file. → realpython.com |
| 2023-11-07 2023 | Using the bpython Enhanced REPL beginner 1 min read | Library for enhancing the Python Read-Evaluate-Print Loop (REPL). This course teaches installation and usage of bpython, a more programmer-friendly alternative to the standard Python REPL. It covers boosting productivity with bpython's features, configuring color themes, using keyboard shortcuts, and contributing to the open-source project on GitHub. Familiarity with Python basics and the standard REPL is recommended. → realpython.com |
| 2023-11-07 2023 | 4 Python Web Scraping Libraries To Mine News Data beginner 7 min read | Library for mining news data, this resource details four open-source Python web scraping tools: PyGoogleNews, NewsCatcher, Feedparser, and Newspaper3k. These libraries enable developers to extract headlines, article content, authors, dates, and summaries from various news sources without requiring API keys, making them suitable for NLP projects and MVPs. |
| 2023-11-07 2023 | Peticali/FastHttpPy intermediate | Library implementing Golang's FastHttp in Python, achieving 63k requests/second, significantly outperforming Uvicorn. Easily installable via `pip install fasthttppy`, it supports static file serving, custom GET/POST request callbacks, and error/404 page configuration. Further performance gains are possible by replacing JSON communication with direct struct handling. |
| 2023-10-29 2023 | fortra/impacket intermediate 2 min read | Library of Python classes for low-level network protocol interaction, including Ethernet, IP, TCP, UDP, SMB1-3, MSRPC, TDS, and LDAP. Impacket supports Plain, NTLM, and Kerberos authentication and offers tools for security researchers to facilitate network protocol research and educational activities. |
| 2023-09-20 2023 | Episode 99: OAuth 2 and Authentication Choices for Your Python Project beginner 2 min read AuthN | Talk on OAuth 2 and authentication choices for Python projects. Features Dan Moore from FusionAuth discussing system setup, device grants, social login, and privacy. Includes a spotlight on a course for implementing Google Login with Flask, covering OAuth 2, OpenID Connect, and session management. Mentions RFC 6749 and RFC 6750 as key resources. → realpython.com |
| 2023-09-20 2023 | How to Authenticate using Keys BasicAuth OAuth2 inPython beginner 1 min read AuthN | Library for authenticating Python applications, focusing on BasicAuth and OAuth2 using keys. It details how to implement these authentication methods for secure API interactions, covering setup and usage within Python projects. The library aims to simplify the process of integrating secure authentication into applications, ensuring data protection and access control. |
| 2023-09-19 2023 | dnspython intermediate 2 min read | Library providing Python implementations for DNS record manipulation, including retrieving MX targets, performing dynamic DNS updates with TSIG keys, and manipulating domain names. It facilitates generating reverse mapping information for A RRs from zone files, converting IPv4 and IPv6 addresses to/from their DNS reverse map names, and converting E.164 numbers to/from ENUM names. |
| 2023-09-02 2023 | Containerized PDF Summarizer with FastAPI and Hamilton intermediate 10 min read | Library for building containerized LLM applications, showcasing a PDF summarizer using FastAPI, Streamlit, and Hamilton. This approach emphasizes modularity and dataflow principles for easier iteration, testing, and maintenance of LLM capabilities, decoupling core logic from platform concerns like API caching and scaling. |
| 2023-09-02 2023 | trafilatura: Web scraping tool for text discovery and retrieval beginner 4 min read | Library for web scraping and text extraction. Trafilatura is a Python package and command-line tool that simplifies gathering text from raw HTML, offering robust discovery and processing components for web crawling, downloads, and extraction of main texts, metadata, and comments. It balances precision and recall, outperforming other open-source libraries in benchmarks, and is used by HuggingFace, IBM, and Microsoft Research. Output formats include TXT, Markdown, CSV, JSON, HTML, XML, and XML-TEI. |
| 2023-09-02 2023 | Running Untrusted Python Code intermediate 5 min read | Library for securely running untrusted Python code by employing a separate process with applied resource limits. It leverages Linux's seccomp to restrict system calls, allowing only essential operations like `read` and `write` to stdout/stderr, while returning `EPERM` for unauthorized calls. Additionally, it utilizes `setrlimit` to control CPU time, virtual memory, and file size, preventing resource exhaustion. The library aims to avoid common pitfalls of in-application sandboxing, acknowledging the complexity and potential for escape vectors inherent in Python's introspection features. |
| 2023-08-24 2023 | The subprocess Module: Wrapping Programs With Python beginner 51 min read | Library for running shell commands and managing external processes in Python. It enables executing commands like `ls` or `dir`, launching applications, and handling input/output streams. The library offers tools for error handling and inter-process communication, making it a flexible option for integrating command-line operations into Python projects. Key functions include `subprocess.run()`, `subprocess.call()`, and `subprocess.Popen()`, differentiating execution methods and output handling. → realpython.com |
| 2023-08-24 2023 | dis Disassembler for Python bytecode Python 3.9.6 documentation beginner 30 min read | Library for analyzing CPython bytecode, the `dis` module enables inspection of compiled Python code. It disassembles functions, methods, and code objects, revealing instructions and their arguments. Key features include support for showing inline caches, specialized bytecode with `show_caches` and `adaptive` parameters, and instruction offsets with `show_offsets`. The `dis.Bytecode` class provides an object-oriented interface for iterating through instructions, and command-line invocation is supported via `python -m dis`. |
| 2023-08-13 2023 | Swing in Python Burp Extensions - Part 1 intermediate 5 min read Burp | Library for crafting Python Burp extensions with custom GUIs using Jython Swing. This guide details implementing tabs, `JPanel` containers with `BorderLayout`, `JButton` actions, `JSplitPane` for layout, `JScrollPane` and `JList` for displaying data, and handling `ListSelectionEvent` with `valueChanged` to prevent double-adding events. It also covers using `JTabbedPane` for multiple tabs and `JTextPane` with `StyledDocument` for styled text, as well as `JEditorPane` for displaying web content, enabling or disabling editing. |
| 2023-08-05 2023 | Socket Programming in Python Part 1: Handling Connections beginner | Socket Programming in Python Part 1: Handling Connections https://ift.tt/2Q3W4zm → realpython.com |
| 2023-08-05 2023 | How To Keep A Secret in Python Apps beginner 67 min read Secrets | Library for securely managing secrets in Python applications, emphasizing practices like avoiding hard-coding credentials, using password managers (like PinPal), and employing threat modeling. It highlights the `keyring` library for OS-native secure storage, contrasts macOS Keychain security prompts with environment variable risks, and discusses using GitHub Actions secrets. Foundational security, including disk encryption and keeping OS updated, is also stressed, alongside creating repeatable security processes and recognizing phishing red flags. |
| 2023-06-08 2023 | Test website for SQL injection vulnerabilities using Python intermediate SQLi | Test website for SQL injection vulnerabilities using Python https://ift.tt/msKlYeM |
| 2023-06-06 2023 | Reversing Pickles with r2pickledec intermediate 10 min read Deser | Tool for decompiling Python pickle files, r2pickledec supports all instructions up to protocol 5. It integrates with Radare2, enabling analysis of pickle contents, including identifying serialized objects like "requests.sessions" and "Session," and understanding the assembly language used in pickles. The tool facilitates reversing complex pickle data by translating the byte stream into human-readable instructions and object structures. → blog.doyensec.com |
| 2023-04-13 2023 | Understanding Python Bytecode beginner | Understanding Python Bytecode https://ift.tt/1NED8CP |
| 2023-04-10 2023 | How to Implement OAuth 2.0 Login for Python Flask Web Server Applications intermediate 4 min read API Sec AuthN | Tutorial on implementing OAuth 2.0 login for Python Flask web server applications. This guide details enabling Google APIs, creating OAuth client IDs, securely storing credentials, and writing Python code using Flask to handle user authentication and consent. It covers setting up a `requirements.txt` file, environment variables, and Jinja2 templates for a seamless Google single sign-on experience, with runnable code available on GitHub. |
| 2023-04-03 2023 | Download and Installation Scapy 2.4.5. documentation beginner 5 min read Fuzzing | Library for packet manipulation and network scanning, Scapy offers installation instructions for various platforms including Unix-like systems, macOS, OpenBSD, Solaris, and Windows. It details methods for installing both the latest stable release and development versions using pip, and outlines optional dependencies for advanced features such as plotting with Matplotlib, 2D graphics with PyX, graph generation requiring Graphviz and ImageMagick, 3D graphics with VPython-Jupyter, WEP decryption and TLS decryption utilizing cryptography, Nmap fingerprinting, and VOIP functionality with SoX. Platform-specific notes cover libpcap integration, native Linux support, and Npcap requirements on Windows. Documentation can be built locally using Sphinx, and UML diagrams can be generated with pyreverse. |
| 2023-04-03 2023 | Scapy beginner Fuzzing | Scapy http://scapy.net/ |
| 2023-04-03 2023 | Usage Scapy 2.4.5. documentation beginner 38 min read Fuzzing | Library for network packet manipulation, Scapy enables users to craft, send, sniff, dissect, and analyze network traffic. Its interactive shell allows for dynamic packet building, layer stacking with operators like `/`, and dissection of raw data. Scapy supports reading and writing PCAP files, graphical packet dumps via PyX, and generating sets of packets using Cartesian products of field values. It provides functions like `send()` and `sendp()` for layer 3 and layer 2 packet transmission, respectively, with options for return packets, looping, and interval control. Advanced features include multicast support with scope identifiers and a `fuzz()` function for randomizing packet fields. |
| 2023-04-03 2023 | Basic and Low-level Python Network Attacks intermediate RCE | https://ift.tt/SxGhvBQ |
| 2023-04-02 2023 | Writing a Network Scanner using Python intermediate Recon | Writing a Network Scanner using Python https://ift.tt/DAWbHwz |
| 2023-01-31 2023 | Build an Arp Spoofer From Scratch intermediate | The content discusses creating an ARP spoofer from scratch. ARP spoofing involves manipulating network traffic by sending false ARP messages. By building an ARP spoofer, one can intercept and modify data packets within a network. This technique is commonly used for malicious purposes like eavesdropping or conducting Man-in-the-Middle attacks. The content likely provides a guide or instructions on how to create an ARP spoofer independently. |
| 2023-01-31 2023 | Creating an Advanced Network Packet Sniffer in Python: A Step-by-Step Guide intermediate | The content is a step-by-step guide on creating an advanced network packet sniffer using Python. It provides detailed instructions on how to build the sniffer tool, which can capture and analyze network packets for various purposes. The guide likely covers topics such as setting up the necessary libraries, capturing packets, analyzing packet data, and potentially implementing additional features for advanced functionality. Overall, the content aims to help readers understand the process of creating a network packet sniffer using Python through a structured and informative guide. |
| 2022-10-19 2022 | Python Simple HTTP Server With SSL Certificate (Encrypted Traffic) intermediate | The content discusses setting up a Python Simple HTTP Server with an SSL certificate to enable encrypted traffic. This configuration enhances security by encrypting data transmitted over the network. The SSL certificate ensures secure communication between the server and clients, protecting sensitive information from potential eavesdropping or tampering. By implementing SSL encryption, the Python Simple HTTP Server can provide a more secure environment for data exchange. |
| 2022-09-18 2022 | Python Cybersecurity beginner | The content titled "Python Cybersecurity" likely discusses the intersection of Python programming language and cybersecurity. Python is commonly used in cybersecurity for tasks like scripting, automation, and developing security tools. It is a versatile language known for its simplicity and readability, making it a popular choice among cybersecurity professionals. By leveraging Python's libraries and frameworks, cybersecurity experts can efficiently analyze data, detect vulnerabilities, and enhance security measures. The link provided likely leads to more detailed information on how Python is utilized in the field of cybersecurity. |
| 2022-09-13 2022 | OWASP Pygoat beginner | Library for developers and testers to learn secure coding and application testing. Written in Python with the Django web framework, Pygoat incorporates OWASP Top 10, Mitre CVE, and SANS 25 Top Errors vulnerabilities like XSS and SQLi. It provides source code alongside vulnerabilities, enabling users to identify and fix insecure coding practices. → owasp.org |
| 2022-09-13 2022 | OWASP Pygoat | OWASP Foundation beginner | Library for learning application security, Pygoat is a Python-based platform built on the Django framework. It includes traditional web application vulnerabilities like XSS and SQLi, and allows users to view source code to understand and fix security flaws. Vulnerabilities can be mapped to OWASP Top Ten, MITRE CVE, and SANS Top 25 errors, providing a practical resource for developers and testers to enhance secure coding and testing practices. → owasp.org |
| 2022-08-17 2022 | 10 Killer Automation Scripts For Your Daily Stuff | by Haider Imtiaz | Aug, intermediate | The content provides a list of ten Python scripts designed to automate daily tasks and streamline work processes. These scripts aim to simplify common problems and routines by leveraging automation. By utilizing these scripts, individuals can save time and effort on repetitive tasks, enhancing productivity and efficiency in their daily activities. → python.plainenglish.io |
| 2022-08-17 2022 | Fake webcam for your online meetings, with Python | by Francois Le Roux | C intermediate | The content discusses using Python to create a fake webcam for online meetings when you prefer not to show your real webcam feed. It highlights the scenario of wanting privacy during virtual meetings. The article likely delves into the technical aspects of how to achieve this using Python programming. |
| 2022-08-15 2022 | A Guide to Python Libraries For Pentesters, Ethical Hackers and System Admi beginner | Python is essential for cybersecurity professionals like penetration testers. It is a versatile tool for various tasks due to its wide range of libraries. These libraries are crucial for tasks such as data manipulation, network scanning, and exploit development. Python's flexibility and extensive library support make it a preferred choice for ethical hackers, system administrators, and cybersecurity experts. |
| 2022-08-11 2022 | The Impossible Web Scraping. Scraping a dynamic website with… | by Nyv Mond intermediate | The content discusses the challenges of scraping dynamic websites using Python libraries like Selenium and BeautifulSoup. These tools help navigate and extract data from websites that require interaction or have changing content. Selenium is used for automating web browsers to interact with dynamic elements, while BeautifulSoup parses the extracted HTML content. By combining these tools, users can scrape data from websites that are difficult to access with traditional scraping methods. |
| 2022-08-10 2022 | How to Protect Text Input from XML External Entity (XXE) Attacks using Pyth intermediate XXE | The content discusses the importance of protecting text input from XML External Entity (XXE) attacks using Python. XXE attacks aim to disrupt an application's handling of serialized data. Implementing countermeasures in Python can help prevent these attacks and safeguard the application from potential vulnerabilities. |
| 2022-05-05 2022 | Favorite tweet by @_zwink intermediate Recon | Favorite tweet: Just created a Python script which given a list of /24 IP address ranges, will crawl them, extract domains and subdomains from SSL certs, check the domains, and write out a CSV file o... |
| 2022-04-25 2022 | Favorite tweet by @JasonFord beginner OSINT Recon | Favorite tweet: I'm continuing to work on my python skills to gather data using threat intel APIs. I've shared this script on GitHub that you can use (with your own API key) to query @EmergingThreats... |
| 2022-03-27 2022 | Python Useful Regex Quick Reference beginner | The content highlights the importance of regular expressions (regex) in Python for text processing. It emphasizes that regex is a crucial tool for manipulating and searching text efficiently in Python programming. |
| 2022-03-27 2022 | An Intro To HTTPX beginner | The httpx package is a Python library that provides an alternative to the requests library for making HTTP requests. It offers features like HTTP/2 support, async and await syntax, and better performance. HTTPX aims to be a more modern and efficient tool for handling HTTP requests in Python applications. |
| 2022-03-27 2022 | Python Cybersecurity — Build a Port Scanner intermediate | The content discusses creating a Python script for a port scanner to detect open ports on a network. It provides a tutorial on the implementation process. |
| 2022-03-27 2022 | 10 Advanced Automation Scripts for Your Python Projects intermediate | The content discusses the use of Python for automating tasks in projects. It highlights the importance of automation for handling both interesting and mundane tasks efficiently. The focus is on utilizing Python scripts to automate various processes in projects, making work easier and more streamlined. |
| 2022-03-27 2022 | Hacking and Securing Python Applications intermediate | The content discusses 27 vulnerabilities commonly found in Python applications, including risks like arbitrary file writes, directory traversal, and deserialization. It emphasizes the importance of being vigilant about these vulnerabilities to secure Python applications effectively. |
| 2022-03-27 2022 | 5 Python Libraries That Will Help Automate Your Life beginner | The content discusses five Python libraries that can automate tasks such as sending emails, extracting data from PDFs, and performing data analysis. These libraries offer resources for quick learning and implementation to streamline daily tasks and improve efficiency. |
| 2022-03-27 2022 | Malware extraction in Python with Scapy intermediate | Learn how to extract malware files from network captures using Python and Scapy in under 200 lines of code. This tutorial demonstrates a concise method for extracting malicious files from network traffic, showcasing the power and efficiency of Python programming for cybersecurity tasks. By leveraging Scapy, a powerful packet manipulation tool, users can quickly and effectively identify and extract malware files for further analysis or mitigation. This streamlined approach highlights the effectiveness of Python and Scapy for cybersecurity professionals in handling malicious content within network traffic. |
| 2022-01-15 2022 | Capturing Network Traffic With Python And TShark intermediate | Capturing Network Traffic With Python And TShark |
| 2022-01-15 2022 | 10 Handy Automation Scripts You Should Try Using Python beginner | 10 Handy Automation Scripts You Should Try Using Python |
| 2022-01-03 2022 | Writing fast async HTTP requests in Python intermediate 7 min read | Library for optimizing fast async HTTP requests in Python. This resource details the evolution from basic `requests` iterative calls to threading with `queue` and `threading`, finally arriving at asynchronous programming with `aiohttp`. It covers techniques like using `asyncio.Semaphore` for controlled concurrency and explores the trade-offs between different approaches for handling large volumes of network requests locally, aiming for maximum throughput and efficiency. |
| 2021-12-30 2021 | Golang Offensive Tools with C-Sto and capnspacehook intermediate RCE | Talk featuring Golang offensive tool developers C-Sto and capnspacehook, discussing Go for red teaming, challenges, and future malware trends. Highlights include C-Sto's goWMIexec and BananaPhone, capnspacehook's pandorasbox, and tools like HackBrowserData, go-netscan, sliver, DeimosC2, and garble for obfuscation and reverse engineering. |
| 2021-12-30 2021 | Ben%20 kurtz%20 %20 offensive%20 golang%20 bonanza%20 %20%20 writing%20 golang%20 malware intermediate | Ben%20 kurtz%20 %20 offensive%20 golang%20 bonanza%20 %20%20 writing%20 golang%20 malware |
| 2021-12-09 2021 | Python 201 for Hackers beginner 1 min read | Library for learning Python for ethical hacking, covering fundamental programming concepts necessary for cybersecurity applications and tool development. This resource is ideal for individuals looking to advance their skills in areas like exploit development and security scripting. The content is structured to build practical abilities, with courses eligible for CEUs and a 24-hour refund policy. |
| 2021-12-06 2021 | How to Brute-Force SSH Servers in Python intermediate 3 min read RCE | Library for brute-forcing SSH servers using Python and the `paramiko` library. This resource details how to implement an SSH brute-force script by iterating through password lists against a target host. It covers connecting to SSH, handling authentication failures and connection timeouts, and utilizing command-line arguments for host, username, and password list input. The script also includes logic to detect and pause on potential rate limiting or quota exceeded errors. |
| 2021-11-28 2021 | Quickstart Web3.py 5.22.0 documentation beginner 2 min read | Library for interacting with the Ethereum blockchain, web3.py offers quickstart documentation covering installation via pip, provider configurations including `EthereumTesterProvider`, `IPCProvider`, `HTTPProvider`, `AsyncHTTPProvider`, `WebSocketProvider`, and `AsyncIPCProvider`. It demonstrates how to connect to local nodes (like Geth on ports 8545 and 8546) and remote node providers, and shows basic usage such as fetching block data via `w3.eth.get_block('latest')`. Further resources on features, APIs, contract interaction, and transaction handling are linked. |
| 2021-11-28 2021 | Quickstart Web3.py 5.23.1 documentation beginner 2 min read | Library documentation for web3.py version 5.23.1 offers a quickstart guide for interacting with the Ethereum blockchain. It details installation via pip, connection methods to Ethereum nodes including IPCProvider, HTTPProvider, and WebSocketProvider, with examples for both local and remote connections. The guide also highlights the use of EthereumTesterProvider for testing and demonstrates how to retrieve block data using `w3.eth.get_block('latest')`. |
| 2021-11-27 2021 | Bit Twiddling in Python beginner | Bit Twiddling in Python |
| 2021-11-20 2021 | Python Scripting for Hackers Part 1: Getting Started beginner 5 min read | Library for learning Python scripting for hacking, covering installation of third-party modules like the `python-nmap` module via `pip` and `wget`, fundamental syntax, formatting importance, running files with `chmod`, and incorporating comments. It emphasizes Python's extensive standard libraries and numerous third-party modules available from PyPI for reconnaissance and other hacking tasks. |
| 2021-11-14 2021 | A Beginners Guide to Python for Cybersecurity beginner 5 min read | Library of Python resources for cybersecurity, detailing its application in penetration testing, automation, and malware analysis. It highlights key libraries like NLTK, NumPy, Pandas, Scikit, Nmap, Twisted, Scapy, Beautiful Soup, Cryptography, YARA, Pymetasploit3, and Mechanize. The entry also touches on its use in SOAR platforms and mentions the Flatiron School's Cybersecurity Engineering Bootcamp for practical application. |
| 2021-11-11 2021 | Game Hacking with Python and cheat engine intermediate RCE | Game Hacking with Python and cheat engine |
| 2021-09-15 2021 | How To Track Phone Number Location With Python intermediate OSINT | How To Track Phone Number Location With Python → python.plainenglish.io |
| 2021-08-25 2021 | API Testing with HTTPie beginner API Sec | API Testing with HTTPie |
| 2021-08-14 2021 | Elliptic Curve Keys Python and Hazmat intermediate | Elliptic Curve Keys Python and Hazmat |
| 2021-08-10 2021 | RSA Signatures Python and Hazmat intermediate | This content likely discusses the implementation and usage of RSA signatures in Python, specifically leveraging the `cryptography.hazmat` library. It would cover how to generate RSA keys, sign data using private keys, and verify signatures using public keys. The focus would be on the practical application of these cryptographic operations within a Python environment, utilizing the robust `hazmat` module for secure and efficient handling of RSA cryptography. |
| 2021-06-15 2021 | Python Cybersecurity beginner OSINT | This content, titled "Python Cybersecurity," appears to be a brief placeholder or topic introduction. It suggests a focus on the intersection of Python programming and cybersecurity. The content is too minimal to extract specific key points, main ideas, or any details regarding bug bounty payouts. It simply indicates that Python is a relevant tool or language within the cybersecurity domain. |
| 2021-06-07 2021 | whey-cewler.py beginner | This content appears to be the name of a Python script, "whey-cewler.py." Without the actual script content, it's impossible to provide a summary of its function or purpose. There is no bug bounty payout amount mentioned. |
| 2021-01-20 2021 | Accessing the Dark Web with Python intermediate | The content discusses using Python to access the Dark Web by creating new Tor identities. This process allows users to browse the Dark Web confidently and safely. By utilizing Python, individuals can enhance their privacy and security while exploring the hidden corners of the internet. |
| 2019-08-26 2019 | A Python prompt into a running process: debugging with Manhole intermediate 4 min read | Library for live debugging Python processes with the Manhole project. This enables attaching an interactive Python prompt to a running application, allowing developers to inspect state, access objects, and diagnose issues beyond standard logging. It discusses security implications, particularly within containerized environments, and provides methods for exposing specific objects and leveraging the garbage collector for debugging. |
| 2019-08-23 2019 | 10 common security gotchas in Python and how to avoid them intermediate | The content discusses 10 common security pitfalls in Python programming and provides tips on how to avoid them. It emphasizes the challenges of writing secure code and highlights the importance of understanding how to properly use language features, modules, and frameworks to prevent vulnerabilities. By being aware of these common security mistakes and following best practices, developers can enhance the security of their Python applications. |
| 2019-08-23 2019 | How to scrape websites with Python and BeautifulSoup beginner | The content discusses the use of Python and BeautifulSoup for web scraping to extract information from websites efficiently. It highlights the vast amount of data available on the internet and the need for tools like BeautifulSoup to gather and process this information. Web scraping allows users to automate the extraction of data from websites for various purposes. |
| 2016-01-21 2016 | python/scapy DNS sniffer and parser - Stack Overflow intermediate | Library using Scapy to sniff and parse DNS traffic. The provided Python code demonstrates how to capture UDP packets on port 53, distinguishing between DNS queries (DNSQR) and responses (DNSRR), and extracting timestamp information. → stackoverflow.com |
Frequently Asked Questions
- What are common Python security vulnerabilities?
- Common Python security issues include unsafe deserialization with pickle, command injection through os.system() and subprocess with shell=True, Server-Side Template Injection in Jinja2, path traversal in file operations, SSRF in the requests library, and SQL injection when using string formatting instead of parameterized queries.
- Why is Python popular in cybersecurity?
- Python's readability, extensive standard library, and rich ecosystem of security packages make it ideal for exploit development, automation, and tool building. Libraries like pwntools, scapy, impacket, and requests are widely used in penetration testing. Python is also the primary language for Burp Suite extensions (via Jython) and many security scanners.
- How do you write secure Python code?
- Use parameterized queries for database access, avoid pickle for untrusted data (use JSON instead), never use eval() or exec() on user input, use subprocess with shell=False and explicit argument lists, validate and sanitize file paths to prevent traversal, and keep dependencies updated to patch known vulnerabilities.
Weekly AppSec Digest
Get new resources delivered every Monday.