New Python challenge for DEF CON 2026: Zurkhaneh Signup.py
A staff-only signup portal with a vulnerability: the domain check reads the address as text, later code reads it as email, so an outside address can get through.
Can you fix it?
In Node.js's mysql package, an object sent where a string was expected becomes part of the SQL by default, even when the query uses placeholders. This results into SQL injection.
New JavaScript challenge:
We're hosting the official CTF of OWASP BeNeLux Days 2026: an AI Attack and Defence Wargame.
Score points by fixing vulnerabilities in your own app and exploiting other players' apps.
12 to 26 November, winners announced in Utrecht.
secdim.com/owasp-benelux/#owasp
We found a ReDoS in OpenTelemetry for Python: one oversized tracestate header can stall an asyncio server for seconds. Fixed in opentelemetry-api 1.45.1 (CVE-2026-114603).
Technical writeup:
