Forward Security

Forward's highly accomplished team specializes in application and cloud security services. Straight talk, technical leadership, and excellence are in our DNA.

[Forward Security @FWD_SEC]

Microsoft Warns Windows Users Not to Fall for False 'Defender Antivirus Is Turned Off' Notifications
https://t.co/hpFUqtW3SQ

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

📍 San Jose next week.

Our Founder & CEO Farshad Abasi is on Stage 7 at @WeAreDevs, Thursday 4:10 PM, with a talk on why your threat model has quietly stopped keeping up in 2026.

If you're there, come find us.

#threatmodeling #wearedevelopers #aisecurity

[Forward Security @FWD_SEC]

X says attackers are targeting user accounts after the launch of X Money
https://t.co/2H8grY0YSr

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face
https://t.co/Ebc57SCUZZ

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

Hackers abuse Faronics Deploy admin tool to install ScreenConnect
https://t.co/a2LXH6VN2x

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

AI agents can now find and exploit vulnerabilities on their own — chaining them together with minimal human intervention.

In Ep. 21 of The AppSec Insiders we break down the Hugging Face attack, AI sandbox escapes, and what this means for AppSec.

🎧 https://t.co/h60mqoBdgl

[Forward Security @FWD_SEC]

Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
https://t.co/B2RY2NvHR5

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

A RAG system is only as secure as its retrieval layer.

LLMs inherit risks from the data they access: poisoned documents, weak tenant isolation, and sensitive data exposure.

Testing the model isn't enough. Are you testing what it can retrieve?

#AISecurity #RAG #OWASP #AppSec

[Forward Security @FWD_SEC]

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents
https://t.co/VA5hJvocWL

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

Audits are easier when security is built in.

SOC 2, PCI, and HIPAA all require evidence that you identify and fix risk.

Security assessments help you find gaps before auditors do.

#Compliance #SOC2 #AppSec

[Forward Security @FWD_SEC]

Your system prompt isn't a vault.

OWASP's 2025 LLM risks now include prompt leakage because attackers can trick models into revealing instructions and hidden data.

Don't store secrets in prompts. Keep controls outside the model.

#AISecurity #OWASP #LLM

[Forward Security @FWD_SEC]

South Korea fines telco giant KT $39 million for customer data breach
https://t.co/3jvfrhEj07

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

Not all identities are human.

API keys, service accounts, tokens, and AI agents can become attack paths when over-privileged.

Know what exists. Limit access. Rotate often.

#IdentitySecurity #AppSec

[Forward Security @FWD_SEC]

AI feature? Start here. 🤖

OWASP's 2025 Top LLM risks include: 1️⃣ Prompt injection 2️⃣ Data leaks 3️⃣ Supply chain 4️⃣ Model poisoning 5️⃣ Output handling 6️⃣ Excessive agency 7️⃣ Prompt leakage 8️⃣ Vector DB flaws 9️⃣ Misinformation 🔟 Resource abuse.

#AISecurity #OWASP #LLM

[Forward Security @FWD_SEC]

Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests
https://t.co/4UFyfhAyiP

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

🚨 Active npm supply chain attack: 868+ packages compromised, 2B+ monthly installs affected and the list is still growing. If you auto-pull dependencies, pin versions, audit recent updates, and rotate exposed credentials.

SCA helps identify your exposure. #AppSec #npm #DevSecOps

[Forward Security @FWD_SEC]

The biggest security risk in AI apps isn't code. It's a sentence.

Prompt injection tops OWASP's LLM risks. Treat every input as untrusted, limit what your model can do, and validate outputs before they act.

Does your AI read outside data?

#AISecurity #OWASP #AppSec

[Forward Security @FWD_SEC]

New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
https://t.co/nYCjEShDKB

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

Cybersecurity firms targeted by fraudulent OpenAI organization invites
https://t.co/mJkYkknXs0

#DevSecOps #SecDevOps #ApplicationSecurity #AppSec #CloudSecurity #CloudSec #SoftwareSecurity

[Forward Security @FWD_SEC]

Hugging Face's latest AI security incident proves a hard truth: prompt guardrails aren't security boundaries.

Test your AI integrations against the OWASP LLM Top 10 before attackers do.

#AISecurity #LLMSecurity