@dkorunic.netPrompt injection via cloned repo: ponytail’s SessionStart hook piped raw repo text (multi-line export { } lists, odd folder names) into the model’s hidden context. PR: identifier-only export entries + safe-path filter.
github.com/DietrichG... #security #appsec #aisecurity
@zachzang.bsky.socialA template engine that fetches user-supplied URLs is an RFI finding
Attacker-controlled remote includes escalate to code execution, not just a bad fetch.
#CPTS #PenTesting #WebSecurity #AppSec
Full CPTS explanation, free: https://navyduck.com/cpts/web-application-penetration-testing/q203
@shehackspurple.bsky.socialSeason 2 of DevSec Station is about AI, agents, application security, and building systems that can survive being surprised.
🎧 Episode 1: **Your AI Worked 59 Times. What About the 60th?**
Listen or watch here: https://twp.ai/9Obuiw
@zaproxy.orgInitial support for handling OAuth2.0 is now available.
Details on the ZAP Blog: www.zaproxy.org/blog/2026-10...
Lots of other add-ons have also been updated, so update ZAP now!
#appsec #zaproxy
@opensecurityconf.bsky.socialWant some inspiration? Check out the recaps from last years: opensecurityconference.org/about/past-c...
#osco #osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
@hacks.grCycode leads a 2026 ranking of 10 platforms that help companies organize software security findings and route them for fixes.
The assessment gave fixin…
@opsmatters.comThe latest update for #GitGuardian includes "The campaign that never stopped: tracking GhostAction from 2025 to 2026" and "#SecretsManagement Best Practices: 6 Reasons Your Vault Needs Detection".
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
@devstackdaily.bsky.socialTools that help developers ship more software should also take on more responsibility for securing it, since developer pace keeps outpacing manual secret…
#DevTools #AppSec #SecureByDefault #ShiftLeft
https://github.blog/ai-and-ml/github-copilot/secret-protection-must-scale-with-software/
@cyberlifecoach.bsky.socialA website can have encryption and authentication and still leak private data.
Web Cache Deception exploits differences in how servers and caches interpret URLs.
I explain how it works and how to mitigate it:
@owaspottawa.bsky.social#OWASP #Ottawa is proud to announce that Magno Logan, product security leader, will present at OWASP Ottawa Day 2026.
"Nobody's Mining Crypto Anymore: What Attackers Actually Want From Your CI"
📅 October 17
📍 UofO - STEM 117
ℹ️ tinyurl.com/87j33b82
🎟️ tinyurl.com/mr2z6z8r
@doyensec.bsky.socialCongratulations to Maxence (@maxenceschmitt.bsky.social) and Yassine on successfully using their three bugs 🤯 to exploit Home Assistant Green (cc: @home-assistant.io ). Tough break that they were previously known - we'll get 'em next time!
@eyalestrin.bsky.socialSSRF impact in cloud environments: Beyond network reachability #appsec
@helpnetsecurity.comAutomation, AI agents or people? Sorting out who handles each security finding
📖 Read more: www.helpnetsecurity.com/2026/10/07/s...
#cybersecurity #cybersecuritynews #infosec #appsec #vulnerabilitymanagement #AIsecurity
@thedailytechfeed.comBurp is 2026’s DAST king—auth, SPA, API-aware testing now table stakes. #DAST #AppSec #BurpSuite #Invicti #StackHawk #Cybersecurity #API #DevSecOps https://thedailytechfeed.com/top-dast-tools-of-2026-full-rankings-buyers-guide/
@opsmatters.comThe latest update for #AikidoSecurity includes "How Aikido helps you meet SOC 2 Type 1 and Type 2" and "Cyber Resilience Act is here! Myth busting and first impressions".
#Cybersecurity #AppSec #DevSecOps https://opsmtrs.com/48vGyRP
@opsmatters.comThe latest update for #Zenity includes "Five Ways #AI Agents Actually Fail, and Why Most Security Programs Are Only Built for Two of Them" and "Introducing AI Total: Detonate Agent Skills Before You Trust Them".
#cybersecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH
@shehackspurple.bsky.social
@empist.bsky.socialGoogle's PageBreak AI agent found 500+ XSS flaws in its own web apps—pairing Gemini models with deterministic validators to cut false positives near zero. A real-world look at proactive risk reduction. #AppSec #CyberSecurity snip.ly/tcp2mr
@owaspottawa.bsky.socialOn behalf of OWASP Ottawa, a huge thank you to Managed Risk Partners for supporting OWASP’s 25th Anniversary event at OWASP Ottawa Day!
Thank you for backing OWASP Ottawa and for helping us celebrate 25 years of AppSec 🙏
@eyalestrin.bsky.socialHorizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS #appsec