CISA's 2026 SBOM rules mandate component hashes—but one security engineer argues they're the weakest link. Here's why verification by hash alone may not be enough.

https://www.reddit.com/r/devsecops/comments/1wg5jps/component_hashes_in_sboms/

#appsec #DevSecOps

Session hijacking flaw in djust SSE transport: framework trusted client-supplied session IDs without verification, letting…

https://dev.to/cverports/cve-2026-61592-cve-2026-61592-session-hijacking-and-authorization-bypass-in-djust-sse-transport-4634

#appsec #DevSecOps

Spain logs first fully autonomous AI agent breach. The real problem: 26% of large enterprises can't even detect rogue agents running in their…

https://dev.to/humanbound_ai/spain-just-logged-its-first-ai-agent-breach-the-detection-gap-behind-it--39p2

#appsec #DevSecOps

300-line Python IDOR tester for bug hunters: swap object IDs in URLs, flag unauthorized access. Advanced. Runs via python3 idor_tester.py --url ... --id-range 1-1000
https://www.valtersit.com/python/insecure-direct-object-reference-idor-tester/
#python #security #appsec

The latest update for #GitGuardian includes "How the GitGuardian Mixin Kit Extends #Docker Sandboxes for Safer #AI Coding" and "#GitHub App Private Keys: 474 Leaked Keys Exposed".

#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb

Open Source Intelligence (OSINT): Investigating Google Accounts with Ghunt #appsec

We just released some new pentesting reporting features into OWASP Faction!

#pentest #appsec #owasp #redteam #cybersecurity #pentesttools

blog.factionsecurity.com/blog/themabl...

Woah, GitHub's AI-powered fuzzing agent really takes on the "human bottleneck" for C/C++ projects! It automates writing harnesses, chasing coverage, and even triaging crashes. Major step for security automation, just be sure to use that "disposable environment" they warn about. 🤯 #AI #AppSec

Researchers Used Claude to Hack OpenAI. Here's Exactly How the Chain Worked
www.thefluxread.com/2026/09/rese...
#CyberSecurity #OpenAI #ClaudeAI #EthicalHacking #BugBounty #ZeroDay #DevSecOps #AISafety #AppSec #TechNews2026

One tap was enough to bypass a Chrome for iOS security check.

We found a way to use shortcuts to reach tel: or facetime: w/o Chrome applying its normal user-interaction checks.

The issue, CVE-2026-13795, has been fixed.

Details 👇
blog.doyensec.com/2026/09/24/c...

#appsec #doyensec #security #ios

How many forgotten tokens still have access to your repos? GitHub Enterprise Cloud now exports a full credential inventory, including SSH keys, PATs, OAuth and App tokens, with scopes and last-used data. devops.com/github-gives... #DevSecOps #GitHub #SupplyChainSecurity #AppSec

The latest update for #Zenity includes "#Gartner Names Zenity a Market Shaper for #AI Application Security" and "The Agent Will See You Now: Why #Healthcare's AI Agent Boom Needs Visibility and Control".

#cybersecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH

Diagnosed our rate limiter eating 62% of CPU time in futex under load — mutex contention on every token check. Rewrote it lock-free (per-token, sync.Map+CAS). Same pass fixed a cascading UDP timeout bug tanking throughput. Result: 32-34k events/sec on a real network path.
#AppSec #golang

The latest update for #AppSentinels includes "What Does #NIST IR 8587 Mean for #API Security?" and "Top 7 #APISecurity Tools for Banks and Fintechs in 2026".

#cybersecurity #AppSec https://opsmtrs.com/3MZSK4Z

The latest update for #SaltSecurity includes "#AI Security Has a Context Problem" and "The Role of #AgenticAI in #Cybersecurity".

#APISecurity #AppSec https://opsmtrs.com/40EBWWv

The latest update for #GitGuardian includes "#GitHub App Private Keys: 474 Leaked Keys Exposed" and "What a #SupplyChain Attack Is Really After: Your Credentials".

#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb

The latest update for #Tines includes "How Headspace is taming wild code with Tines 3B" and "'Better than the tools we were quoted six figures for': How Tines' finance team built a custom billing app for <$1,000".

#cybersecurity #nocodesecurity #appsec https://opsmtrs.com/3LFedhc

Come join our co-founder Luca Carettoni at #BEX Thursday 9/24 at the Rimini Expo Center 🇮🇹! He'll be available to chat about the cool projects we've done for helping to secure the space industry and the final frontier 🖖!

www.bex-expo.space/en

#appsec #doyensec #security

npm ‘btree’ Malware Campaign Affects Millions of Downloads, No Need for Install Script #appsec

Malicious npm campaign targets developers integrating Twilio #appsec