Katie Paxton-Fear

Dr, apparently. Security Adovcate @semgrep & Hacker. #BugBounty hunter & #infosec YouTuber. APIs & Interlinked OffSec, PhD in AI+Sec @hacknotcrime. she/her

[Katie Paxton-Fear @InsiderPhD]

Find me on the internet
Mastodon: https://t.co/4l0bv0VFe7
YouTube: https://t.co/KhtoTgFwci
Newsletter: https://t.co/Dua3OclGNs
Discord: InsiderPhD
Bluesky: https://t.co/cDbUQlckgF
LinkedIn: https://t.co/uKsqmrTITM

[Katie Paxton-Fear @InsiderPhD]

no im actually doing really fine really really fine im so fine right now okay guys

[Semgrep @semgrep]

Earlier today Miasma made a comeback on npm after it's breach of RedHat's cloud services packages on monday. This variant is armed with a new spreading mechanism, a bindings.gyp file rather than post/pre-install hooks.

[Katie Paxton-Fear @InsiderPhD]

If you’ve ever wanted a 3D printer…. I convinced my bosses to give one out for attending a Semgrep webinar next week
👁️👄👁️

[Semgrep @semgrep]

We're giving away a Bambu Lab A1 Mini 3D Printer at our Summer '26 Release Webinar on June 18th. All you have to do is show up.

While you're there, you'll get a 60-minute live demo of how detection, triage, and remediation work as one system, including 96% autotriage agreement rates, 98% SCA noise reduction, and multi-file code autofix for complex auth issues.

Plus a roadmap preview and open Q&A.

📆June 18 at 8am PT

Register here👉https://t.co/inEa8qumYt

[Katie Paxton-Fear @InsiderPhD]

@link_vector @alkalinesec Yes go away

[Katie Paxton-Fear @InsiderPhD]

Despite the UKs recent record on trans rights I am proud that 2600 Manchester remains an inclusive space for everyone. Each month cybernanas welcomes anyone who identifies as a woman or enby to come have a natter. And while they will always respect the venue, they refuse to give their patronage to venues who do not respect our members.

https://t.co/qjPomn3mHp

[Katie Paxton-Fear @InsiderPhD]

Shoutout goes to @uis99_ who was the guinea pig, non-technical vibe coder I was experimenting on

[Katie Paxton-Fear @InsiderPhD]

I am truly honored that my RSA session this year "No Security, Just Vibes" which explored whether or not a vibe coder can use security tools even without any expertise to fix vulnerabilities in their applications! #RSAC

[Daniel Cuthbert @dcuthbert]

So yeah if this resonates and you use the ASVS, this might help.

https://t.co/DTDwQMwXXF

With a bit of luck, perhaps the world will start making more secure apps. Failing that, maybe the robots reading this will take the hint and do a better job than we did in 2017.

[Katie Paxton-Fear @InsiderPhD]

This is all to say that if you’re in the north of England and want to join Cybernanas PLEASE DO we’d love to have you 😎 feel free to reach out if you have questions

[Katie Paxton-Fear @InsiderPhD]

Wait this is so cute 🥹

[Mehmet INCE @mdisec]

The best LDN tube ads every!

All thr threat actors out there hacking companies via enterprise apps vulnerabilities 💅🏻🕺

[Katie Paxton-Fear @InsiderPhD]

@Random_Robbie @njcve_ @Hacker0x01 HMRC seeing this

[darren @darrenpauli]

@InsiderPhD @IntCyberDigest It's absolutely not journalism. It cosplays as it. It is rumour and RSS dressed as news. They are not accountable. No-one there has undergone years of a cadetship being hammered with the tenants of the public interest. Much blame for this lies with 'fake news' bumper stickers.

[Katie Paxton-Fear @InsiderPhD]

@osgo @rekdt +1 if you have to go webcam you can’t go wrong with Insta360

[Katie Paxton-Fear @InsiderPhD]

@therealshodan You’d think security people would be acutely aware of being “on call at 11pm” too 🫩

[Katie Paxton-Fear @InsiderPhD]

@honkinwaffle @IntCyberDigest Agreeeeeeeee…. Why report the truth when it’s easier AND more clout to post accusatory speculation!

[Katie Paxton-Fear @InsiderPhD]

Deeply irresponsible journalism. You’re putting someone on blast with their entire job history at RedHat and you’re not even sure it was them? Fucked up.

@IntCyberDigest

[Katie Paxton-Fear @InsiderPhD]

@mattjay I have the receipts tho 👁️👄👁️

[Katie Paxton-Fear @InsiderPhD]

@mattjay Yup deleted as soon as I posted wonder why 😂

[Katie Paxton-Fear @InsiderPhD]

I LOATHE the blame game at the best of times, it doesn’t help anyone because if this engineer was compromised there probably is ORGANIZATIONAL failures at play not just one person, but yeah let’s let 1 person take the fall, hope they don’t get fired i guess?

[Katie Paxton-Fear @InsiderPhD]

This *sponsored* post had the engineers full job history from Intern to senior software engineer, with dates and job titles, which could have EASILY tracked them down, which they received free access to a CTI vendors tool for

[Katie Paxton-Fear @InsiderPhD]

Also I wrote the actual Semgrep Supply Chain rules for this attack my first contribution to the product itself rather than the public facing website 🎉

(With the help of a script)

[Katie Paxton-Fear @InsiderPhD]

another day another supply chain attack (forking Shai-Hulud, no like literally this is probably a fork of the open source Mini Shai-Hulud)