@owasp.org🎉 OWASP is 25! Celebrate with us! 🎁 Join OWASP between today and 30th Sept and get 1 FREE year's individual membership to gift to a friend. More people, more knowledge, more AppSec! 🔐
One membership. Twice the impact. bit.ly/OWASPBringaFr...
@cybercod.bsky.socialDid you know Broken Access Control is the #1 OWASP risk? 🏆 Scanners usually miss IDORs. Pro-tip: Manually swap IDs in requests to see if you can access data you shouldn't. Logic flaws need human eyes, not just scripts. #AppSec #OWASP #WebSecurity
@eyalestrin.bsky.socialA quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill #appsec
@eyalestrin.bsky.socialPlugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected #appsec
@getpacketai.bsky.socialOWASP's 2026 LLM Top 10 reveals where AI security risks really live—and it's not always in the model. Incident data shows the bigger threat is in the systems around it.
https://www.resilientcyber.io/p/the-2026-owasp-llm-top-10-and-the
@cyberlensai.bsky.socialThe security question for agent tools is not just 'does it work?' It is 'what can it do when it is wrong, compromised, or over-permissioned?' #AIAgents #AppSec
@filesigsec.bsky.socialBuild AI securely. Break it on purpose. Fix what you find.
Build and Break AI (DEV + PEN): www.amazon.com/dp/B0H74CWYSV
@getpacketai.bsky.socialJFrog Artifactory under active attack: researchers confirm in-the-wild exploitation of three critical vulns chained for admin access. If you're serving…
@getpacketai.bsky.socialFound the same local admin password on every workstation? The real risk isn't weak entropy—it's the blast radius. Here's how to write a finding…
@getpacketai.bsky.socialHTTP request smuggling exploits disagreements between proxies and app servers on request framing. When your front-end and back-end parse HTTP differently, attackers…
https://dev.to/rockyyy/the-bug-that-hides-between-two-servers-that-disagree-about-http-3760
@getpacketai.bsky.socialA critical CVE sat in production for 11 days because the image scan was moved after deploy to speed up pipelines. One team's costly lesson in why…
@getpacketai.bsky.socialAI agents getting real API keys is a security disaster. One developer built capbroker to prove it and show how…
@getpacketai.bsky.socialDeleted your S3 bucket but forgot to update DNS? An attacker can claim the bucket name in seconds and serve malicious content under your…
@cvedatabase.bsky.socialSecurity Tip: Prune your dependencies! 🛡️ Unused packages increase your attack surface and technical debt. Regularly audit your project manifests to remove bloat and reduce the risk of supply chain attacks. Keep your stack lean.
#CVE #InfoSec #AppSec
@doyensec.bsky.socialThe skb that wasn’t freed - the Fragnesia primitive via Open vSwitch.
#Doyensec found a local priv. esc. affecting default Arch, Fedora, Debian, Amazon #Linux & RHEL. Read how a missing flag allows an unprivileged user to gain root access.
@cybercod.bsky.socialOWASP Pro-tip: Broken Access Control is #1 for a reason. Scanners often miss logic flaws, so manually test if swapping an ID in a URL lets you see someone else’s data. Tools find the holes; humans find the flaws. 🛡️
@getpacketai.bsky.socialAI agents are writing code before AppSec can see it. Shift-left security may need a complete rethink as the control point moves further upstream than most programs can reach.
https://www.resilientcyber.io/p/the-left-in-shift-left-moved
@owasp.org🔐 The OWASP MAS team, Sven Schleier & Carlos Holguera, has been working with the Dutch Ministry of the Interior and Kingdom Relations (MinBZK) on the EUDI program to support secure certification for EUDI Wallets.
Find out what they’ve been working on 👇
owasp.org/news/owasp...
@secdb.bsky.socialsecdb-cli 0.5.0 🚀
Point it at a repo → discovers every manifest → known vulns as inline diagnostics + SARIF with file & line.
Plain LSP over stdio: Neovim, Kate, Zed, any LSP editor.
@eyalestrin.bsky.socialWhen Apps Outlive Vendors: Security Implications of IoT Abandonware #appsec