Check out our core values and how they shape the conference and also our organizer team: opensecurityconference.org/about/values/
#osco #osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
@opensecurityconf.bsky.social
@opensecurityconf.bsky.socialCheck out our core values and how they shape the conference and also our organizer team: opensecurityconference.org/about/values/
#osco #osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
@opsmatters.comThe latest update for #AppSentinels includes "What Google Gemini's Sandbox Escape Reveals About Securing #APIs Against #AI Agents" and "What Does #NIST IR 8587 Mean for #API Security?".
#cybersecurity #APISecurity #AppSec https://opsmtrs.com/3MZSK4Z
@owaspottawa.bsky.social#OWASP #Ottawa is pleased to announce that Alexander Rudolph, PhD presenting @ OWASP Ottawa Day 2026 on:
"Canadian Digital Sovereignty in a Zero-Trust World"
📅 October 17, 2026
ℹ️ Information: github.com/OWASP-Ottawa...
#DigitalSovereignty #CyberSecurity #Canada #OWASPOttawa2026 #AppSec
@owaspottawa.bsky.socialOn behalf of #OWASP #Ottawa, a huge thank you to Mark Cimon and the Cimon Real Estate Team for supporting OWASP’s 25th Anniversary event at OWASP Ottawa Day!
Information and tickets:
github.com/OWASP-Ottawa...
#OWASP #Ottawa #OWASPOttawa2026 #AppSec #Cybersecurity #Community
@remotejobs2504.bsky.social💰 $30–$100/HR | APPLICATION SECURITY ENGINEER 🔐💻
🌍 Remote (~15 hrs/week)
Experienced in AppSec & backend?
Use your expertise to help train next-generation AI.
🔐 Pentesting • OWASP • Secure Coding • Python • Java
@owaspottawa.bsky.social
@darinor.comCSP Nonces and the Same-Origin Policy Solve Different Problems www.darinor.com/blog/csp-non... #Appsec #WEBSecurity #CSP
@cvedatabase.bsky.socialSecurity Tip: Implement a Software Bill of Materials (SBOM) strategy. 🛡️ Knowing exactly what's in your software stack is the first step to securing it. Use tools to automate SBOM generation and track component risks. Learn more: https://cvedatabase.com #SBOM #InfoSec #AppSec
@scott.keck-warren.comWhen people say PHP isn't secure, I point them to how every release improves security a little bit. PHP 8.6 makes sessions secure by default (check your SSO and payment callbacks before upgrading).
https://www.phparch.com/2026/09/stop-writing-php-like-this-8
@owasp.org🎉 Last call! Offer ending September 30th! 🎁 Join OWASP between today and 30th Sept and get 1 FREE year's individual membership to gift to a friend. More people, more knowledge, more AppSec! 🔐
One membership. Twice the impact. bit.ly/OWASPBringaFr...
@hugovalters.bsky.social300 lines of Python that fuzzes web templates for SSTI and flags vulnerable engines. Advanced. Run: python3 ssti_tester.py --url URL
https://www.valtersit.com/python/server-side-template-injection-ssti-tester/
#security #python #appsec
@cyberlensai.bsky.socialThe security question for agent tools is not just 'does it work?' It is 'what can it do when it is wrong, compromised, or over-permissioned?' #AIAgents #AppSec
@freerave.bsky.socialLesson: Never ship static credentials in client bundles.
Read the full engineering post-mortem on Dev.to:
dev.to/freerave/the...
@sempf.infosec.exchange.ap.brid.gyWho says CSRF isn't a real vulnerability?
https://thehackernews.com/2026/09/elementor-csrf-flaw-lets-attackers-take.html
@sydseter.comBurned out development teams and people sleeping during threat modeling sessions.
The realities of doing security is not that pink as we want to portray it, and our tools and processes not that smooth.
#cornucopia #security #awarness #games #threatmodeling #threatmodelling #appsec
@opsmatters.comThe latest update for #GitGuardian includes "#AI Coding Agents Are Leaking Credentials: Cursor, Claude Code, Copilot, and MCP" and "How the GitGuardian Mixin Kit Extends #Docker Sandboxes for Safer AI Coding".
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
@getpacketai.bsky.socialSupply chain attacks aren't just about injecting malicious code—they're credential theft operations targeting developer machines and CI/CD pipelines. Here's what defenders are missing.
https://blog.gitguardian.com/supply-chain-attack-targets-credentials/
@getpacketai.bsky.social474 valid GitHub App private keys leaked in the wild—some with org admin access. GitGuardian's research shows the scale of secrets exposure risk and why secrets detection matters for DevSecOps…
https://blog.gitguardian.com/github-app-private-keys-leaked/
@getpacketai.bsky.socialThree major AI agent vendors just got caught trusting the pin, not what's pinned. Plugin4Shell shows how attackers can swap malicious code into Copilot, Claude, and Gemini—a supply…
https://dev.to/humanbound_ai/three-ai-agents-one-trust-boundary-problem-14l
@getpacketai.bsky.socialCISA's 2026 SBOM rules mandate component hashes—but one security engineer argues they're the weakest link. Here's why verification by hash alone may not be enough.
https://www.reddit.com/r/devsecops/comments/1wg5jps/component_hashes_in_sboms/