Pedram Hayati

We adopted AI coding tools, our developers ship faster, and the AI already knows the OWASP Top 10.

AI can tell you what your software does.

Some vulnerabilities are patched once and forgotten.

The patch for LangChain vulnerability CVE-2025-68665 disables loading secrets from environment variables by default, and introduces an escape wrapper to prevent injection.

In June 2025, a vulnerability (CVE-2025-48432) was discovered in Django that allowed remote adversaries to tamper with log output by maliciously crafting the request.path.

I travel a lot for business and need to carry many business cards.

A research study comparing click-on (instant lookup) vs key-in (manual typing) digital dictionaries found that easier look up methods reduced spelling knowledge retention by 20-30%.

I deliver this workshop through SecDim.

LLMs currently struggle to consistently adhere to instructions in the presence of prompt injections.

Web3 security is a whole new world where we should re-learn and change our perspective on AppSec.

I hosted an AppSec CTF contest for the Absolute AppSec Podcast community.

I was interviewed by Ogrodje podcast.

This article was originally published on SecDim.

This article was originally published on SecDim.

I rebuilt and lectured this course through Curtin University.

I presented a talk on “Http Parameter Pollution” at BSides Budapest.

I lecture this course through UNSW Canberra at ADFA.

I lecture this course through UNSW Canberra at ADFA.

Browsers’ security controls, backend security libraries and HTTP response security headers have made it very difficult to exploit common security vulnerabilities (yes, you know it, XSS!).

This article was originally published on elttam.

This article was originally published on elttam.

This article was originally published on elttam.

This is highlights from my one hour presentation at HITB 2015 Conference in Amsterdam.

Active defence (or active defense) is relatively a new approach within IT security field.

Honeypot systems have been around for more than a decade.

Summary The experiment highlights the correlation among sources and types of attacks across Amazon EC2 geographic zones (or regions) by using Smart Honeypots.

Summary The research study investigates Secure Shell (SSH) attacks on Amazon EC2 cloud instances across different AWS zones by means of deploying Smart Honeypot (SH).

Different variance of ‘old’ php-cgi remote code execution vulnerability (i.e.

You want to create a reverse shell and your box seats behind a NAT, a proxy, or a firewall and you don’t have enough access to modify the settings on those edge devises to allow an incoming port.

My recent write-up on a summary of the research experiment (botCloud) has got interesting international coverage.

This article was originally published on Stratsec Blog Hosting network services on Cloud platforms is getting more and more popular.

If you’ve ever tried to use SSH from your Android device, you’ve likely encountered the frustrating limitation of missing terminal keys on the stock keyboard.

NFS is the traditional lightweight and superfast file sharing solution on mainly Nix and BSD distros.

Mutt is hard to adopt, but once you learn it, you love it.

A simple command execution with the .lua code.

This solution leverages a discrepancy in how file permissions are checked versus how files are opened.

Taskwarrior is a minimalist command line tool to organise tasks and to-do lists.

Problem Stock android-based devices do not have support for Persian/Farsi languages as yet (up to version 4.0) but there are some custom modified android devices that some-how support Persian languages.