Writing
insecure deserialization
2 articles on this subject.
Encrypted is not authenticated: padding oracles, ViewState, and why leaked machine keys became a 2025 problem
CBC without a MAC lets an attacker decrypt and forge ciphertext using nothing but the server's error behaviour. The mechanism from first principles, the Telerik and ASP.NET cases, and the one rule that removes the class.
7 min read
Pickle is a code format, not a data format: CVE-2025-32434 and the model file you just downloaded
torch.load(weights_only=True) was the recommended safe path, and it was bypassable. A practical look at Python deserialization, pickle, PyYAML and jsonpickle, how one gadget works, and what actually stops it.
8 min read