@getpacketai.bsky.socialNearly 2 million malicious open source packages tracked since 2017—and Q3 2026 alone saw 149K new detections. npm still dominates, but the real threat: 74% of malware…
https://www.sonatype.com/blog/q3-2026-open-source-malware-index-when-compromise-compounds
@getpacketai.bsky.social15K unvetted MCP servers are a ticking supply chain bomb. Remote servers can run code that doesn't match their repos—giving your agents tool access and data…
https://dev.to/coridev/15465-public-mcp-servers-zero-vetting-what-that-means-for-your-agents-5ha0
@getpacketai.bsky.socialAI code generation is outpacing traditional security scanning. Manicode Security's Ron Perris explains why embedding secure coding patterns into LLM context is more…
https://absolute-appsec-eps.s3.us-west-1.amazonaws.com/episodes/Absolute_AppSec_Ep_335.mp3
@securestep9.bsky.social#Anthropic launches FREE AI-powered vulnerability scanning service for established #opensource projects that have a critical impact on infrastructure and user security.
🔍 Periodic scans using Claude Mythos
🤖 Fully AI-generated reports
#AppSec
👇
@owaspottawa.bsky.social#OWASP #Ottawa is proud to announce that the dynamic duo of Logan MacLaren and Fennix will present:
"50 Shades of Red - Red Teaming & Pentesting in Practice"
📅 October 17, 2026
📍 UofO- STEM 117
ℹ️ tinyurl.com/87j33b82
🎟️ Tickets (free): tinyurl.com/mr2z6z8r
@gadgetry.bsky.socialA compromised release of the Tensorlake npm SDK (v0.5.144) delivered an obfuscated credential-stealing worm with an active dead-man switch.
The ChainDrop supply chain attack steals cloud tokens, developer keys, and wipes hosts if GitHub access is revoked.
@owasp.org🦎 What if your honeypot could adapt to the attacker?
CHAMELEON-REN is an adaptive web honeypot helping researchers observe, understand, and learn from real-world web attacks.
Curious how it works? 👀👇
@owaspboston.bsky.socialOur upcoming meetup is made possible by Maze!
This month Shubham Santosh Upadhyay will dive into Prompt Injection — what causes it and whether it can be detected.
RSVP to secure your spot: www.meetup.com/owaspboston/...
@bsidesberlin.bsky.socialSPEAKER SPOTLIGHT ⚡
Catch Yunus Aydın from Trendyol at #BSidesBerlin as he presents "Your AI Just Leaked a Secret"—revealing how "vibe coding" & commit metadata expose leaked secrets across thousands of GitHub repos.
👉 Schedule & Tickets: bsides.berlin
#AISecurity #DevSecOps #AppSec
@cvedatabase.bsky.socialSecurity Tip: Rotate your API keys regularly! 🛡️ Static secrets are a ticking time bomb. Automated rotation limits the window of exposure if a leak occurs. Use a secrets manager to handle the heavy lifting. Stay informed at https://cvedatabase.com #InfoSec #CyberSecurity #AppSec
@shehackspurple.bsky.socialQuestion for you: What's one security control you've added (or changed) specifically because your team started using AI coding tools?
I'd love to hear what people are actually doing right now.
@opsmatters.comThe latest update for #SaltSecurity includes "Your #AI Transformation Needs Runtime Protection for the Whole Agentic Estate" and "When a Security Guardrail Detects the Attack and Still Can't Stop It".
#cybersecurity #APISecurity #AppSec https://opsmtrs.com/40EBWWv
@potato.softwareThe latest update for #Zenity includes "Zenity for Claude Tag: Securing the Shared Agent in Your Slack Workspace" and "Meet Dai Fujimoto: Building Zenity's Next Chapter in Japan".
#potatosecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH
@opsmatters.comThe latest update for #Zenity includes "Zenity for Claude Tag: Securing the Shared Agent in Your Slack Workspace" and "Meet Dai Fujimoto: Building Zenity's Next Chapter in Japan".
#cybersecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH
@opsmatters.comThe latest update for #GitGuardian includes "#AI Coding Assistants Are Unpredictable. GitGuardian AI Hooks Give You Control" and "The campaign that never stopped: tracking GhostAction from 2025 to 2026".
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
@eyalestrin.bsky.socialSecret protection must scale with software #appsec
@eyalestrin.bsky.socialNever Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight #appsec
@eyalestrin.bsky.socialTensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack #appsec
@dkorunic.netPrompt injection via cloned repo: ponytail’s SessionStart hook piped raw repo text (multi-line export { } lists, odd folder names) into the model’s hidden context. PR: identifier-only export entries + safe-path filter.
github.com/DietrichG... #security #appsec #aisecurity
@checkmarxzero.bsky.social