ITSEC Newsletter 2026-08-20

This guide is a practical tour of SAML vulnerabilities, from the classic signature attacks to the parser-differential and digest-confusion attacks that appeared in 2025. Each section links to a hands-on PentesterLab exercise so you can practice the attack, not just read about it.

This will be mostly rambling disguised as a technical walkthrough. I will touch on certain topics such as hardware roots of trust, signed image formats, Qualcomm boot stages, Android Verified Boot, UEFI, measured boot, and remote evidence (remote attestation). My idea is that I will briefly introduce the concepts and then introduce a seemingly perfect-world-example that can still break under certain assumptions. So, expect a technical post leaning towards offensive security.

Your code editor extensions auto-update and run with your privileges on the machine that holds your source code, your SSH keys, and your publishing credentials, but they rarely show up in a software bill of materials.