Executing arbitrary Python code from a comment

A Bishop Fox advisory: two HTTP request splitting (smuggling) flaws in Twisted Web 19.10.0 can cause cache poisoning, session hijacking, and filter bypasses; upgrade to 20.3.0rc1.

Trail of Bits released ProtoFuzz, a Python 3 library generating fuzzed protobuf messages from .proto definitions: valid structures filled with malicious values to attack code behind deserialization.

This coverage gives security teams current context for monitoring, validation, and remediation.

This technical writeup demonstrates practical payload crafting for Ruby ERB template injection vulnerabilities.

GitLab researchers found five malicious PyPI packages, including typosquats of Flask, Requests, and NumPy, that deploy the Shai-Hulud worm via .pth files to steal CI/CD credentials.

Abusing subtle Python behaviors — os.path.join truncation, urljoin quirks, class pollution — to turn developer assumptions into path traversal and, sometimes, RCE, with payload-construction guidance.