hAPI_hacker

{
"name": "Corey J. Ball",
"author": "Hacking APIs",
"creator": " true
}

[hAPI_hacker @hAPI_hacker]

@brysonbort Whenever I’m in these sorts of meetings I start with, “I know this is a lot easier for me to say than for you to do…”

[OWASP® Foundation @owasp]

🏆 Some exciting news to share!

OWASP OASIS is a finalist in the 2026 SANS Difference Makers Awards in the Innovation of the Year (Open Source Product or Tool) category!

Now we need your help to bring home the win! 🗳️

The community vote helps decide the winner, and voting closes on November 9. If you have a minute, please show your support and cast your vote here:

👉 https://t.co/xa3Mn3wNkw

Important: Make sure you click through to the very end of the form for your vote to count!

A huge congratulations to Michael, Chris, and everyone in the OWASP OASIS community who have helped make this possible, from validating fixes and leading sessions to getting their teams involved. This recognition belongs to you all! 👏

#OWASP #SANSDifferenceMakers #OpenSource

[OWASP® Foundation @owasp]

📚 Bookworms, assemble! 🤓🐝

The OWASP bookstore at Global AppSec USA is bursting with brilliant reads! From hacking and AppSec to secure coding, AI, and everything in between, there's something for every curious mind.

Fancy adding to your bookshelf or picking up some new skills? Come and have a browse in the Expo Hall. Your next favorite read might be waiting! 📖🔥

#OWASPSanFran26 #GlobalAppSec26 #OWASP #AppSec

[Sterling Chin @SilverJaw82]

@Sannhq is now open source and officially in beta!

Sannr is an API platform built for coding agents. As your agents use the Sannr API client, it captures the API context and stores it in your repo, right next to the code, so all future coding agents have access to the context.

My favorite was using the @twilio API a couple weeks ago, and coming back to it last night, only to see that my coding agent didn't have to relearn that one of the endpoints needed form encoding. This knowledge ins't something that is part of the OpenAPI spec, or in the docs. It comes from coding agents using the endpoint, learning it, and then writing it down in the sannr.json as a note.

Sannr is designed to be used by coding agents, but I understand that human operators want to see into the black box of coding agent decisions, so I built the Sannr Workbench and Map.

* The Workbench is a place to view all the provenance (the who, what, where, when, and why) around an API. You can filter, add notes of your own, view traces, and re-verify the context.

* The Map gives you a view of the connections between APIs and what files they're connected to.

Links to the repo, our youtube channel, and more are in the first comment.

[James Kettle @albinowax]

I've been nominated for the SANS Difference Makers Awards, in the Red Teamer category! I'd love your vote: https://t.co/OQUGPuIam7
If I win*, I'll share something that genuinely surprised me involving a website, a vulnerability, and GLM 5.3 #SANSDMA #DifferenceMakers

*I'll also share it if I lose

[hAPI_hacker @hAPI_hacker]

@MiaAI_lab "When we added weekly limits to Max20x, we set them to 10x Pro's". 🤔

[hAPI_hacker @hAPI_hacker]

@MiaAI_lab Looks like we're losing 20x in this new naming scheme...

[Jayson E. Street 💙 🤗💛 @jaysonstreet]

Even though I’m currently unemployed & still looking for work I’m trying to stay busy! I’m happy to say my latest project is completed!
https://t.co/OLcdCZX2wj
has been turned into Street_OS! 😊
I think the transformation from my old one to this is amazing!!! 🤩

[a16z @a16z]

In a single year, AI has rewritten the security priority list for CISOs.

Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.

There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.

In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.

The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)

Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)

From a16z's @OwenColby and @steph_zhang on The New Security Agenda: https://t.co/C814PJ4wGg

[hAPI_hacker @hAPI_hacker]

One of the best prep spots out at @SAINTCON. Let’s hack some APIs in one hour!

[NSA Cyber @NSACyber]

UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: https://t.co/nuXgQ10Fzc

[hAPI_hacker @hAPI_hacker]

Patch away everyone! PHP patches are out now: https://t.co/ejsyMVaDax

PHP2Shell Resources:
Cloudflare is helping: https://t.co/dggo4bLNPc

NSA Cyber is saying if you cannot patch it, take it offline until you can patch: https://t.co/0hQ2MtylsL

Wiz PHP2Shell RCE Research: https://t.co/aH4KQ3NjJ3

Don't take it from me even the Prime Minister of Japan, Sanae Takaichi, says to patch!

[高市早苗 @takaichi_sanae]

皆様に、今夜に対応して頂きたい大至急のお願いです。

多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。

公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。

修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。

国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X

[Abdulmalik_cybersecurity @malik_cybersec]

live @ APISEC CON 2026
@apisecu @hAPI_hacker

[Burp Suite @Burp_Suite]

🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.

Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:

🟧 ActiveScan++ v2.0.13 (https://t.co/fkhECQ6wtD)
🟧 Bambda scan checks (https://t.co/PxPcj5uDYX)
🟧 BChecks (https://t.co/i8c8WiDnvb)

Start scanning for the vulnerability now → https://t.co/fkhECQ6wtD

[John Hammond @_JohnHammond]

phucking patch
https://t.co/BfAkbWUZE5
https://t.co/ZQ4kp2n3d5
https://t.co/rTWr1nukhx

[NSA Cyber @NSACyber]

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

[No Starch Press @nostarch]

Your next security skill starts with a good book.

Save 30% on hacking and security books with code STAYSHARP through October 9.

Print books include the free ebook. Sale excludes preorders.

https://t.co/1c0H3zCyLi

[hAPI_hacker @hAPI_hacker]

@Jhaddix https://t.co/Pr1hlKhHSD

[hAPI_hacker @hAPI_hacker]

@malik_cybersec Congrats on your journey @malik_cybersec 💪🚀