@owaspottawa.bsky.social#OWASP #Ottawa is proud to announce that Sabrina Lavi , Security Champions Community Lead is speaking at OWASP Ottawa Day 2026.
"Scaling AppSec Through Champions, Community, and Culture"
📅 October 17
📍 UofO - STEM 117
ℹ️ tinyurl.com/87j33b82
🎟️ tinyurl.com/mr2z6z8r
@owaspottawa.bsky.socialOn behalf of OWASP Ottawa, a huge thank you to ForwardJS for supporting OWASP’s 25th Anniversary event at OWASP Ottawa Day!
Thank you for backing OWASP Ottawa and for helping us celebrate 25 years of AppSec 🙏
@black-bug.bsky.socialAI‑generated bug reports are drowning Google’s open‑source bounty. We need smarter triage, not just more payouts. #AppSec #AI
@techfinitive.comAI powered agents can now reverse engineer compiled software binaries in minutes. ⚡
As automated vulnerability discovery and exploit creation scale up, simply compiling code into binaries is no longer enough to protect software logic, IP, and licensing.
@eyalestrin.bsky.socialGoogle issues complete OSS VRP bug bounty pause over AI spam #appsec
@shehackspurple.bsky.socialQuestion for you: What's one security control you've added (or changed) specifically because your team started using AI coding tools?
I'd love to hear what people are actually doing right now.
@hasamba72.bsky.socialUnpatched account takeover in LiteLLM (CVE-2026-93355). JWT auth falls back to unverified email claims, allowing login as proxy_admin and permanent SSO rebinding. CVSS 8.8. #LiteLLM #CVE #AppSec https://www.ox.security/blog/litellm-an-ordinary-login-token-can-become-someone-elses-admin-account/
@shehackspurple.bsky.socialI'm curious what other AppSec and AI practitioners think (that's you).
What security controls do you see as essential for AI agents? And what are we still not sure about? What are your 'may haves'?
Article: https://twp.ai/9Obx3f
@getpacketai.bsky.socialAI coding agents are shipping broken access control that passes review—here's why it's hard to catch and how to prevent tenant data leaks in automated development.
https://snyk.io/blog/ai-coding-agents-broken-access-control/
@getpacketai.bsky.socialRenaming your .NET code buys you almost nothing against determined reverse engineers. Control flow obfuscation is what actually costs attackers time —…
@cybercod.bsky.socialGlad to see the enthusiasm! 🚀 Moving to continuous security is a total game-changer. Start small by automating basic scans in your CI/CD pipeline. Let me know if you need tips on where to begin! #AppSec #DevSecOps
@getpacketai.bsky.socialObfuscating an SDK is totally different from an app—rename the wrong thing and you break every customer's build. Here's how to protect .NET libraries…
@cyberupdates365.bsky.socialCritical CVE-2026-103922 affects Capacitor apps on Android and iOS.
A malicious in-app link can potentially load attacker-controlled content under the application’s trusted WebView origin.
@getpacketai.bsky.socialPostgreSQL 42501 errors blocking your writes? A Supabase dev breaks down row-level security policy failures and the six causes to check first.
https://dev.to/toritic/supabase-42501-new-row-violates-row-level-security-3g66
@getpacketai.bsky.socialDe4dot makes a one-click meal of basic .NET obfuscation. Learn what actually slows attackers down — and why the real defense is keeping secrets off the client.
https://dev.to/zero_heartbeat_06a3625d7a/de4dot-and-net-deobfuscation-what-actually-stops-it-4ik4
@getpacketai.bsky.socialGot a suspicious .NET DLL? Learn how to safely dissect it without running the risk—static analysis reveals what code will do before you ever execute it.
https://dev.to/zero_heartbeat_06a3625d7a/how-to-safely-analyze-a-suspicious-net-assembly-2nbf
@getpacketai.bsky.socialYour AI coding assistant is leaking secrets in places your scanners can't see. Cursor, Copilot, and Claude Code all leave credentials in config files and logs—here's where and how to fix it.
https://blog.gitguardian.com/ai-coding-agents-credential-security/
@offseq.bsky.socialCRITICAL vuln in Monta monta.app (CVE-2026-95102, CVSS 9.4): missing WebSocket auth lets attackers impersonate charging stations. Restrict endpoint access & monitor activity. More: https://radar.offseq.com/threat/cve-2026-95102-cwe-306-in-monta-montaapp-d0effdc35e6b46a2 #OffSeq #CVE202695102 #AppSec
@potato.softwareThe latest update for #Zenity includes "Introducing #AI Total: Detonate Agent Skills Before You Trust Them" and "The Authorization Trap: Why 'No Evidence of Manipulation' Doesn't Mean 'No Incident'".
#potatosecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH
@opsmatters.comThe latest update for #Zenity includes "Introducing #AI Total: Detonate Agent Skills Before You Trust Them" and "The Authorization Trap: Why 'No Evidence of Manipulation' Doesn't Mean 'No Incident'".
#cybersecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH