Toby Davenport

Notepad++ recently disclosed a compromise of its shared hosting infrastructure that affected its update endpoint. Threat actors altered update endpoints within configuration files to deliver a malicious version of the software to specific targets. This resulted in downstream users – potentially including businesses – downloading what appeared to be a legitimate update, but which gave attackers a foothold on compromised devices and therefore internal networks.

Many times, during software security testing (penetration tests), whitelisting and blacklisting are encountered, with testers trying to bypass the regex (regular expression). But, what is the actual process of identifying these characters that can bypass filters? How are new payloads formed? If you're looking for some technical, offensive security insights, you've come to the right place...

A CVE (Common Vulnerabilities and Exposures) is a standardised identifier for a specific security vulnerability in a software application, hardware device, or system. Our pen tester Toby takes you through this latest discovery - CVE-2023-40017.

A CVE (Common Vulnerabilities and Exposures) is a standardised identifier for a specific security vulnerability in a software application, hardware device, or system. Our pen tester Toby takes you through this latest discovery - CVE-2023-40017.