@opsmatters.comThe latest update for #GitGuardian includes "#AI Agent Security: Six Controls From Nine Real Incidents" and "AI Coding Assistants Are Unpredictable. GitGuardian AI Hooks Give You Control".
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
@dashaun.comScope swapping attacks work because OAuth requests pass through the browser. PAR pushes them over the back channel instead. Here's how it works. #OAuth2 #SpringSecurity #AppSec
@sydseter.comOWASP Cornucopia just released v3.5.5 (github.com/OWASP/cornuc...)
A Special thanks to Prajakta G. Kamble and Adarsh Kumar for all the bug fixes.
@codemagic.bsky.socialStable SDKs are not safe. Vulnerabilities slip in constantly. How often do you audit dependencies? 🛡️ #AppSec https://smartlinks.live/l/xV2Pmh
@opsmatters.comThe latest update for #Tines includes "IT #onboarding automation: building a provisioning agent with Tines 3B" and "How Headspace is taming wild code with Tines 3B".
#cybersecurity #nocodesecurity #appsec https://opsmtrs.com/3LFedhc
@getpacketai.bsky.socialCritical auth flaw in Langflow lets unauthenticated users access private workflows and execute components. Upgrade to 1.10.1 or…
@cyberlensai.bsky.socialThe security question for agent tools is not just 'does it work?' It is 'what can it do when it is wrong, compromised, or over-permissioned?' #AIAgents #AppSec
@owaspottawa.bsky.socialOn behalf of #OWASP #Ottawa, a huge thank you to Mark Cimon for supporting OWASP’s 25th Anniversary event at OWASP Ottawa Day!
đź“… October 17, 2026
đź“Ť University of Ottawa - STEM 117
ℹ️ Information: tinyurl.com/87j33b82
🎟️ Tickets (free): tinyurl.com/mr2z6z8r
@eyalestrin.bsky.socialGhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories #appsec
@getpacketai.bsky.socialParallels Desktop flaw lets unprivileged users escalate to root via appliance installs—a critical risk for developers using the virtualization platform for local testing and…
https://jfrog.com/blog/parallels-desktop-turns-appliance-install-into-root-shell/
@freegardener.bsky.socialSilent security failures don't start where you think. New SAGE research shows most begin turns before vulnerable code is written—in plans #CyberSecurity #AIAgents #AppSec #DevSecOps
https://freegardner.com/synapse/silent-security-failures-start-before-vulnerable-code.html
@getpacketai.bsky.socialOne argument-injection bug took down OpenAI Codex at Pwn2Own—exposing how AI agents fail where traditional security tooling can't see the attack…
@getpacketai.bsky.socialNearly 2 million malicious open source packages tracked since 2017—and Q3 2026 alone saw 149K new detections. npm still dominates, but the real threat: 74% of malware…
https://www.sonatype.com/blog/q3-2026-open-source-malware-index-when-compromise-compounds
@getpacketai.bsky.social15K unvetted MCP servers are a ticking supply chain bomb. Remote servers can run code that doesn't match their repos—giving your agents tool access and data…
https://dev.to/coridev/15465-public-mcp-servers-zero-vetting-what-that-means-for-your-agents-5ha0
@getpacketai.bsky.socialAI code generation is outpacing traditional security scanning. Manicode Security's Ron Perris explains why embedding secure coding patterns into LLM context is more…
https://absolute-appsec-eps.s3.us-west-1.amazonaws.com/episodes/Absolute_AppSec_Ep_335.mp3
@securestep9.bsky.social#Anthropic launches FREE AI-powered vulnerability scanning service for established #opensource projects that have a critical impact on infrastructure and user security.
🔍 Periodic scans using Claude Mythos
🤖 Fully AI-generated reports
#AppSec
👇
@owaspottawa.bsky.social#OWASP #Ottawa is proud to announce that the dynamic duo of Logan MacLaren and Fennix will present:
"50 Shades of Red - Red Teaming & Pentesting in Practice"
đź“… October 17, 2026
đź“Ť UofO- STEM 117
ℹ️ tinyurl.com/87j33b82
🎟️ Tickets (free): tinyurl.com/mr2z6z8r
@gadgetry.bsky.socialA compromised release of the Tensorlake npm SDK (v0.5.144) delivered an obfuscated credential-stealing worm with an active dead-man switch.
The ChainDrop supply chain attack steals cloud tokens, developer keys, and wipes hosts if GitHub access is revoked.
@checkmarxzero.bsky.social
@owasp.org🦎 What if your honeypot could adapt to the attacker?
CHAMELEON-REN is an adaptive web honeypot helping researchers observe, understand, and learn from real-world web attacks.
Curious how it works? 👀👇
