Siva Bhargava

Dad | A Principal Product Security Engineer in Banking/FinTech industry. Views expressed here are my personal.

[Siva Bhargava @bhargava_ms]

@miryalasrikanth

[Zack Korman @ZackKorman]

If you want to know the state of AI in cybersecurity, the CEO of one of the biggest cybersecurity companies posted that switching models is hard because “no one has figured out how to abstract memory and context and history away from models.”

Models are stateless.

[Caido @CaidoIO]

We built Caido to be API-first. Now an open source AI pentest agent drives Caido.

Pentest Copilot, from @BugBase, added Caido as a first-class backend: HTTP History, Replay, Automate, Intercept, and OAST.

It all runs on our official SDK, and works over MCP too.
This is what API-first is for.

Try it now https://t.co/cwsn89wybI

[Luke Stephens (hakluke) @hakluke]

🚨 New blog! 🚨

Are bug bounties cooked? Is cybersecurity cooked? I'm worried about backlash from releasing my opinions on this, but here it is anyway.

https://t.co/Oliw0yxkoB

[Siva Bhargava @bhargava_ms]

@CaidoIO Thanks a lot for the support. I acknowledge that it was a mistake from my side of using the wrong account to login.

[Siva Bhargava @bhargava_ms]

Hi @CaidoIO your paid subscription seems to have some issue. I am being charged monthly but my profile says basic. I can’t cancel my billing , can’t access paid features but still paying monthly. Very disappointed.

[Siva Bhargava @bhargava_ms]

@blackroomsec If you have Opus access try this harness and see if it is any good at autonomous exploit development, it will answer a lot of questions about Mythos as well. https://t.co/nbUTCqPGFJ,

[Siva Bhargava @bhargava_ms]

@KrishBhargav 😁

[Cat @CatInShambles]

fuck you

[Siva Bhargava @bhargava_ms]

@rez0__ @0x0SojalSec Is it possible to port the skills from Claude code to Codex?

[Siva Bhargava @bhargava_ms]

Traceability from source to sink across multiple repos is a problem unsolved in SAST world. To identify business logic flaws it is a crucial feature to have for SAST tools. Claude code security could be a game changer.

[Claude @claudeai]

Introducing Claude Code Security, now in limited research preview.

It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss.

Learn more: https://t.co/n4SZ9EIklG

[Siva Bhargava @bhargava_ms]

@clowndownunder The council allows subdivision and attached house for lands above 500 sqm and with 15 m frontage, the price is for the land. They will construct 2-3 new houses in the same land and sell fkr 2 mil each.

[Soroush Dalili @irsdl]

🚨
1- CVE-2025-53770 is a variant of CVE-2025-49704 - a critical auth bypass in SharePoint's ToolPane.aspx endpoint. It lets attackers reach a page that can parse webparts without valid credentials, and with a chained deserialization bug, they can achieve RCE entirely in memory if they wish. #SharePoint

2- To defenders: block access to ToolPane.aspx in your WAF or IIS. Warning: you may lose custom web part editing until a proper patch arrives. Blocking based on referer is also good but a bit trickier.

3- What went wrong in Microsoft's auth bypass patch? Two flawed checks:
A) Path.EndsWith("/ToolPane.aspx") + referer match: bypass with an extra slash (/ToolPane.aspx/)

B) path contains "_layouts" & ends with /ToolPane.aspx: bypass via query string (_layouts/15/ToolPane.aspx/?/ToolPane.aspx)

4- Even more devious: charset‑encoded URLs can hide the string "/ToolPane.aspx" from WAFs. And HTTP/1.x header folding or leading spaces can break simple referer filters.

5- If your machine key was auto-generated and exposed, attackers might decrypt/forge viewstate. Rotate those keys: delete old registry entries or recreate the app pool with a new name and assign it to the application.

Microsoft is expected to ship a follow‑up patch. Until then, stay vigilant with URL filtering and header validation.
#infosec #cybersecurity
https://t.co/3jEVoChZAn

[nader dabit @dabit3]

New Video - Mastering @AnthropicAI Claude Code: 11 Tips in 4 Minutes for Vibe Coding Excellence.

• Terminal tips and tricks
• Deep dive into @cursor_ai IDE extension
• Overriding permissions
• Creating custom slash commands
• Chaining multiple commands
• + a lot more

[Nicolas Krassas @Dinosn]

Hunting Deserialization Vulnerabilities With Claude https://t.co/pP0sqfopn3

[Joshua Saxe @joshua_saxe]

Today our AI security team @ Meta launched open source tools to support the open source GenAI ecosystem, including:

- LlamaFirewall; a security-first guardrail framework for mitigating agentic prompt injection, misalignment, and insecure coding risks: https://t.co/lNxQB34jmz

[Avi Chawla @_avichawla]

Let's build an MCP-powered Agentic RAG (100% local):

[JS0N Haddix @Jhaddix]

Gonna drop one the biggest blogs and analysis on real world usage of AI and security around implementations next week or the week after!

With security resources for testers!

[Abhay Bhargav @abhaybhargav]

You need this!

If your devs are vibe-coding. They need to understand secure coding, security architecture, DevSecOps and perhaps even cloud security

If your devs are NOT vibe coding. They need to understand secure coding, security architecture, DevSecOps and perhaps even cloud security

Leveling up engineering teams on security is the only way to get ahead of your security problems with the least effort and cost.

But you're spending massive $$ exclusively on fixing symptoms than on actually fixing the underlying problems.