21/10/2026Four new PHP challenges, three from real incidentsFour new challenges are live in the PHP game: Steam.php, Insecure Normalization.php, Capital0.php and Command Injection.php. The first three are...
20/10/2026Nine AWS challenges, updatedWe have updated the nine challenges in the AWS game on SecDim Play. AWS is responsible for the security of...
15/10/2026NDC London 2026 | Vibe Coding Security WorkshopIn 2025, one AI builder reproduced the same insecure defaults across 170 independent applications — not because 170 developers made...
13/10/2026Three new Ruby challenges, Including JSON smugglingWe have released three new challenges in the Ruby game: Chapar Khaneh Manifest.rb, Chapar Archive.rb and Divan Export.rb. Chapar Khaneh...
08/10/2026AISA CyberCon Melbourne 2026We will be speaking at AISA CyberCon 2026 in Melbourne next Week During the session we will examine why CVE...
07/10/2026GlassWorm and a new incident response challengeGlassWorm is a software supply-chain worm targeting developers through malicious packages and extensions. It spreads through malicious VS Code…
06/10/2026New course: Supply Chain SecurityMost of the code in an application was not written by the team responsible for it. It comes through dependencies,...
01/10/2026Secure coding AI Wargame at NDC OsloWe ran a three-day Attack & Defence AI Wargame at NDC Oslo 2026. Developers stopped by our booth between talks...
30/09/2026XXE Injection, now in six languages on SecDim PlayIn December 2024, a vulnerability was identified in http4k, a toolkit for Kotlin HTTP applications. It could allow access to...