Paul

Application Security | Software Dev | DevSecOps |
Contributor @OwaspShepherd | @[email protected]

#appsec #devsecops #infosec #owasp

[Myrtus @Myrtus0x0]

If you want a really honest case study of this, please read:

https://t.co/QspOPLlCTv

[Thomas Roccia 🤘 @fr0gger_]

https://t.co/DDrdRSaLzn

[Tib3rius @0xTib3rius]

THEY MADE A WORM IN NPM
THEY MADE A WORM IN NPM
THEY MADE A WORM IN NPM
THEY MADE A WORM IN NPM
THEY MADE A WORM IN NPM

[JFrog Security @JFrogSecurity]

🚨We're continuing to track the unfolding compromise of npm packages with a new data exfiltrating malware, in the new campaign dubbed Shai Hulud.

Our monitoring infrastructure has detected 31 additional malicious packages with the same payload with hundreds of versions.

New malicious packages are still being uploaded continuously, follow this thread to get the latest news on this ongoing campaign as it unfolds.

[Philipp Krenn @xeraa]

always the weekend to research (non) security issues 😬
https://t.co/gAX8Jx4Tbk

[Charlie Marsh @charliermarsh]

Oh wow, a popular GitHub Action (tj-actions/changed-files) was fully compromised. Someone committed a base64-encoded payload that runs a script that in turn prints out encoded secrets…

Stay safe out there!

[Thomas Roccia 🤘 @fr0gger_]

🤯 The level of sophistication of the XZ attack is very impressive! I tried to make sense of the analysis in a single page (which was quite complicated)!

I hope it helps to make sense of the information out there. Please treat the information "as is" while the analysis progresses! 🧐 #infosec #xz

[Matt Johansen @mattjay]

A new container escape vulnerability just dropped.

It gives an attacker the ability to hop from container to host OS via runc.

[Aditya Gujar @fyoorer]

One Supply Chain Attack to Rule Them All https://t.co/Ycb0oYpzZw

[Daniel Lemire @lemire]

We should reject the culture of laziness and/or incompetence. "Some tool somewhere report something and so we must do what it suggests right away".

Yes. We care about security. Yes. We care about bugs. Yes. We want good tools, good reports.

But blindly following flags and tools? No. It does not make you safer.

Take time to understand the issues first.

[daniel:// stenberg:// @bagder]

CVE-2020-19909 is everything that is wrong with CVEs

Another 9.8 CRITICAL curl problem. All made up.

https://t.co/iiWAnJHCYh

[LiveOverflow 🔴 @LiveOverflow]

The world just became a little bit safer 🥰
thanks to all the hackers and researchers reporting vulnerabilities
https://t.co/cysmKl1gn0

[Steve Wilson @virtualsteve]

It's official! Version 1.0 of the OWASP Top 10 for LLMs is here covering the top security risks for AI developers today. Please check it out! https://t.co/CI05o6ch3s

[Paul @ismisepaul]

@zaproxy Best of luck folks!

[Zed Attack Proxy @zaproxy]

ZAP is joining the Software Security Project (and leaving OWASP). For more details see https://t.co/QmFRmGFHwp

[Chainguard ⛓️ @chainguard_dev]

Elastic enlisted us to engage in an assessment of their software supply chain using the SLSA framework-- the largest one we've done to date! 🌟
https://t.co/5X3cdmpTMM

[Gareth Rushgrove @garethr]

I wrote some code! Introducing Parlay, a CLI tool for enriching an SBOM with extra information about the compinents https://t.co/kyxcOJIVe9

[Dan Lorenc @lorenc_dan]

The hardest problem in supply chain security is explaining what supply chain security is.

[ikakavas at infosec dot exchange @ilektrojohn]

Hey Oracle can you be a little more vague with the CVEs you release in your CPUs ? https://t.co/i5r9ie0zKk Boilerplate statements every quarter..

Anyone has additional info on CVE-2023-21930 ?