Victor Mengwa Iphy

AppSec | Husband | Kingdom proclaimer

[Dharmvir @dharmvir_]

Visa sponsorship + Remote jobs + Freshly funded startups:

European Tech Visa Sponsorship
https://t.co/ABgF4qHgGE

US Tech Visa Sponsorship
https://t.co/po7seD1Emj

Japan Tech Visa Sponsorship
https://t.co/AcsVOyNTs5

150 Remote Companies Hiring
https://t.co/AeykzYnjRs

100% Remote Hiring Companies
https://t.co/4zgjNrfV0R

400+ San Francisco Bay Area companies
https://t.co/uLmPgvUNrl

1500+ Recent Funding Startups
https://t.co/qKhTjz6wqf

Indian Startups Freshers DS/ML/AI Hiring 2026
https://t.co/UB4KxiIKpX

Indian Robotics Startups Database
https://t.co/kzj5SWYMU2

1300+ Hidden Companies Hiring List
https://t.co/PTZT3ccqlo

Bookmark it.
Repost it to help others.

Share with your friends.

[Victor Mengwa Iphy @IphyViktor]

@SirAlexanderrr Interested

[Victor Mengwa Iphy @IphyViktor]

@KaizerOj 🤣🤣🤣
Odechi

[7h3h4ckv157 @7h3h4ckv157]

Modern offline first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, explainable findings, source exploration, AI-assisted investigation and professional reporting.

Resource/Credit: https://t.co/GpiUjONqfx

[Victor Mengwa Iphy @IphyViktor]

@AppleSupport @AppleSupport I have been trying to create an Apple account for months now with success. I have been stuck on phone number verification for months. Can't verify because OTP cannot be sent to my phone number.
At this point, I give up.

[Victor Mengwa Iphy @IphyViktor]

What am I watching?
#FRAENG

[Victor Mengwa Iphy @IphyViktor]

Part of your secure code training should include vulnerabilities or recurring vulnerabilities that you found in a given period of time.

[Victor Mengwa Iphy @IphyViktor]

Omoooor! England ooooo!

[Victor Mengwa Iphy @IphyViktor]

Mobile app security testing: what most teams miss

Mobile apps get tested differently to web applications, and often less thoroughly.
Common gaps in mobile security assessments:
→ Sensitive data stored insecurely on device — shared preferences, SQLite databases, logs containing PII or session tokens
→ Certificate pinning not implemented — allows interception of API traffic
→ Insecure deep link handling — enabling account takeover flows
→ Application logic in the client — validation that can be bypassed
→ API keys hardcoded in the binary — extractable via static analysis in minutes
→ Insufficient session management — tokens that don't expire

For lending and fintech apps, these aren't theoretical risks. Mobile is the primary channel.

The OWASP Mobile Top 10 is your testing baseline. When did you last test against it?

#MobileSecurity #AppSec #OWASP #FintechSecurity

[Victor Mengwa Iphy @IphyViktor]

As Penetration Testers, I think it will be beneficial to report vulnerabilities that have real impact to the business rather than just reporting irrelevant findings. Businesses need to spend time and money to remediate on 'real' vulnerabilities.

[Victor Mengwa Iphy @IphyViktor]

https://t.co/cLjyPH8q0l

[Coy Emerald (Yunus) 🇳🇬🇺🇦 @CoyEmerald1]

Again, keep your DOINGS clean and honest, like you're expecting the @PoliceNG , abi @officialEFCC , or even @OfficialDSSNG 🌚

& keep your online accounts SECURE with Two-Factor Authentication #2FA, like you're expecting the #malicious hackers, awọn tí wọn k�� gbọ́ ńpa 😂COY E.

[Victor Mengwa Iphy @IphyViktor]

@MrCharlesky Interested

[Victor Mengwa Iphy @IphyViktor]

OMG! This game is on its head ọ.

[Victor Mengwa Iphy @IphyViktor]

These Egyptians are running riot.
Up Pharoahs!

[Victor Mengwa Iphy @IphyViktor]

@EOEboh Use DTOs

[Victor Mengwa Iphy @IphyViktor]

"There is nothing more poisonous than 'I can't'. You CAN, if you believe."
- Kuai Liang (Sub-Zero)

[Victor Mengwa Iphy @IphyViktor]

Started learning Golang some 3 weeks ago using YouTube and the docs. I needed a platform that could help me reenforce all the concepts I'm learning. I found https://t.co/keyzNrzi13
Never looked back since then.

[NebuSec @nebusecurity]

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security.

This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version.

This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

[Victor Mengwa Iphy @IphyViktor]

@moemudi01 @vinijr scores!!!