Hunting evasive vulnerabilities
Summary: PortSwigger Director of Research James Kettle presented a keynote at Nullcon Berlin on hunting evasive vulnerabilities, drawing on a decade of web security research to examine what hid both individual bugs and entire attack classes. The talk covers vulnerabilities that are too advanced or too stupid, well-masked, hiding in plain sight, or armoured by inconvenience, and also explores what definitely doesn't work.
Key Takeaway: The premise is the vulnerabilities you've missed and whether someone else will find them later - a direct question for any team that assumes its current scanning has already surfaced what matters.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026