DefectDojo

Remediating at the speed of AI

#AppSec #DevSecOps #ASPM #AppSecPipeline

[DefectDojo @defectdojo]

🚀 DefectDojo v3.5.100 is out.

Permission Audit shows what each user can reach, with CSV export. An Exploit Evidence filter finds Findings with a known exploit. Default Profiles give every Group member the same setup.

Full changelog: https://t.co/vl4XuEXJFf

[DefectDojo @defectdojo]

The squeeze didn't end with October. Neither does the offer.

1,000 free Sensei fixes, now through Nov 30. Connect a repo and turn on automatic remediation.

Sign up: https://t.co/8IX7pVqYSH

[DefectDojo @defectdojo]

Sensei raises the package to the fixed release and changes "*" to "*NP*" in a pull request. Deterministic fixes, in DefectDojo Pro 3.5.100.

Fight AI with AI before new vulns drop tomorrow.

[DefectDojo @defectdojo]

Another day, another vulnerability.

Early Light now detects *sshole, the OpenSSH password bypass on musl (Alpine, OpenWrt, Void). Sensei fixes it.

[DefectDojo @defectdojo]

Early Light checks the sshd, its package, sshd_config, the accounts and the salt sshd would borrow, then names the exposed accounts. Free and open source:
https://t.co/MyX823cyYv

[DefectDojo @defectdojo]

Five nightly imports: five Tests, the same 16 Findings in each, and nothing marked Mitigated after the fix.

Reimport feeds one Test and compares each scan to the last. Gone means closed. Back means reopened.

Read the post: https://t.co/Rf8FCzv3nJ

[DefectDojo @defectdojo]

3/ The MCP server. Ask Claude, Cursor or any MCP client about your findings. Read-only by default, scanner text marked as untrusted, no telemetry.

docker run -i --rm https://t.co/wKogb53Qq2

https://t.co/vydlRdfqEf

[DefectDojo @defectdojo]

1/ Most open source security tools are islands. DefectDojo Community Edition just got two official bridges, both free. 🧵

[DefectDojo @defectdojo]

2/ The GitHub Action. Add one step after your scanner. It imports the report into DefectDojo and fails the build at the severity you pick.

uses: DefectDojo/defectdojo-action@v1

https://t.co/x4OnJwVWpa

[DefectDojo @defectdojo]

Awareness doesn't close a finding. A merged pull request does.

Sensei opens the pull request. Your team reviews and merges. 1,000 free fixes for everyone through Nov 30.

Sign up: https://t.co/8IX7pVqYSH

[DefectDojo @defectdojo]

🚀 DefectDojo v3.5.0 is out.

Organizations, Assets, and Findings can be archived instead of deleted. Sign-ins get an optional idle timeout. CrowdStrike Falcon now imports Identity Protection detections.

Full changelog: https://t.co/jiCTPTlF0A

[DefectDojo @defectdojo]

Sensei fixes it in DefectDojo Pro 3.4.303. It moves Node.js, .NET and Bun pins, image tags and OS packages to fixed releases and verifies every change before the pull request.

Fight AI with AI before new vulns drop tomorrow.
https://t.co/NYG2F1usoU

[DefectDojo @defectdojo]

Another day, another vulnerability. CVE-2026-111497 (Brotli2Shell) hides inside Node.js, .NET and Bun. Early Light now detects it. Sensei fixes it. 🧵

[DefectDojo @defectdojo]

Early Light checks each binary for evidence of the fix instead of trusting the version it reports. Free and open source:

earlylight scan image --detector brotli your/app:latest

https://t.co/MyX823cyYv

[DefectDojo @defectdojo]

You don't need a circular saw to hang a shelf. You'll want one to frame a house.

Community Edition: 360+ parsers, free forever. Pro adds Upstream Connectors, risk-based prioritization, and the Triage Engine.

Read the post: https://t.co/4H82710C1K

[DefectDojo @defectdojo]

Cybersecurity Awareness Month ends this week. The budget squeeze on security teams doesn't.

1,000 free Sensei fixes for everyone through Nov 30. Connect a repo and review the pull requests Sensei opens.

Sign up: https://t.co/8IX7pVqYSH

[DefectDojo @defectdojo]

🚀 DefectDojo v3.4.300 is out.

Findings can be edited in place, without the Edit form. The notification inbox is generally available. Connectors can list unmanaged devices your EDR sees.

Full changelog: https://t.co/dtj0qyrt7l

[DefectDojo @defectdojo]

Last week: an eMudhra CA key that was the number 4, two RCEs in the PHP engine, and 600 new CVEs a day.

We're bringing Mythos-powered code analysis to market. Premium x2 and Enterprise customers get one free through Nov 13.

[DefectDojo @defectdojo]

In June, FIRST forecast about 66,000 CVEs for all of 2026.

We passed it in September.

This is just the beginning. https://t.co/Z1FpnsoUNO