@secdim

Developer security wargame where developers practice real-world security incidents.

 Sydney, Australia (HQ)
secdim.com
Joined October 2014
  • Tweets458
  • Following3
  • Followers284
274Media
Four new PHP challenges: a TOCTOU race, a Unicode username takeover, server-side request forgery and command injection. Three are inspired by real incidents at Steam, Spotify and Capital One.
1
99
Read the full article: secdim.com/news/four-new-php…

Four new PHP challenges, three from real incidents | SecDim

Four new challenges are live in the PHP game: Steam.php, Insecure Normalization.php, Capital0.php and Command Injection.php. The first three are...

secdim.com
41
secdim.com/news/nine-aws-cha…

Nine AWS challenges, updated | SecDim

We have updated the nine challenges in the AWS game on SecDim Play. AWS is responsible for the security of...

secdim.com
26
AWS secures the cloud. What you run in it is yours to secure, and S3, IAM, VPC and EC2 each need different hardening. We've updated the nine challenges in our AWS game. Link in the reply.
1
1
48
discuss.secdim.com/t/glasswo…

GlassWorm and a new incident response challenge

GlassWorm is a software supply-chain worm targeting developers through malicious packages and extensions. It spreads through malicious VS Code extensions and npm packages. It has a hidden payload...

discuss.secdim.com
4
We will be hosting a 2 day workshop on vibe coding security at NDC London🇬🇧 Come by Room 10 to say Hi if you are attending 👋 👉 secdim.com/news/ndc-london-2… #appsec #securecoding #ndclondon
2
41
Rails wraps a non-Hash JSON body under _json, and a client can send that key itself. One request, two readings. If authz and the action read different ones, that's a bypass. New Ruby challenge:
1
1
48
secdim.com/news/three-new-ru…

Three new Ruby challenges, Including JSON smuggling | SecDim

We have released three new challenges in the Ruby game: Chapar Khaneh Manifest.rb, Chapar Archive.rb and Divan Export.rb. Chapar Khaneh...

secdim.com
29
We will be speaking AISA CyberCon 2026 in Melbourne 🇦🇺 Only 1 week left!
1
1
44
melbourne2026.cyberconferenc…

40,000 CVEs and counting: What 60 years of AppSec tells us | CyberCon 2026

Sixty years of AppSec history shows which vulnerability problems are structural, which are self-inflicted, and where security investment finally pays off.

melbourne2026.cyberconference.com.au
20
GlassWorm needed no vulnerability. It shipped as a VS Code extension, hid its loader in invisible Unicode, then spread itself with stolen GitHub tokens. New Incident Response challenge:
1
45
secdim.com/news/glassworm-an…

GlassWorm and a new incident response challenge | SecDim

GlassWorm is a software supply-chain worm targeting developers through malicious packages and extensions. It spreads through malicious VS Code extensions...

secdim.com
13
Your team writes only part of the code it ships. Dependencies, build tools, CI plugins and AI assistants expand the supply chain you need to defend. Learn how to map and harden it, including AI-related risks.
1
1
24
learn.secdim.com/course/supp…

SecDim - Learn

Learn Secure Software Engineering - SecDim

learn.secdim.com
12
At NDC Oslo's three-day Attack & Defence AI Wargame, competitors secured their apps while finding flaws in opponents' apps. Maksim Ohvrill led at the second-evening prize ceremony and received the winner's prize. Try it:
2
1
70
play.secdim.com/game/ai

Play - SecDim

Learn AppSec & DevSecOps via git-based challenges

play.secdim.com
15
An XML parser that accepts external entities can turn untrusted XML into file access, SSRF or command execution. That was the vulnerability identified in http4k in December 2024. Try the SecDim Play challenge, available in six languages.
1
1
44
secdim.com/news/xxe-injectio…

XXE Injection, now in six languages on SecDim Play | SecDim

In December 2024, a vulnerability was identified in http4k, a toolkit for Kotlin HTTP applications. It could allow access to...

secdim.com
16
We found CVE-2026-102274 in PyJWT: one malformed RSA key could stop an entire JWK Set from loading. Fixed in 2.14.0. Technical writeup:
1
1
1
259
secdim.com/blog/post/cve-202…

CVE-2026-102274: Malformed RSA JWK Aborts PyJWT JWK Set Parsing | SecDim

SecDim Security Research reported CVE-2026-102274 to the PyJWT maintainer on 2026-09-05, and the vulnerability was subsequently fixed in PyJWT 2.14.0....

secdim.com
1
51
Load more