ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

This monthly InfoSec roundup surveys recent web‑security research and conference highlights, covering ORM leak vulnerabilities (Django and Prisma), revived CSRF attacks via client‑side path traversal, notable RCE and exploit writeups (including a ServiceNow exploit chain affecting over 40,000 instances), XSS/XXE findings, new pentesting resources (Xdebug white‑box guides, WAF bypass modules), and broader discussion on ML‑driven malware, LLM issues, and InfoSec community insights.