Vercel confirms breach as hackers claim to be selling stolen data Cloud development platform Vercel has disclosed a security incident after threat actors claimed to have breached its systems and are attempting to sell stolen data.

⚠️ #Vercel hacked.
The popular platform behind tens of thousands of AI apps and the creator of NextJS framework has confirmed a breach. Hackers claiming to be ShinyHunters are selling stolen customer + employee data:
#databreach
👇

www.bleepingcomputer.com/news/securit...

Want to present a talk at the #OWASP Global #AppSec Conference 2026 in San Francisco in November?
Call For Papers is now open
👇

Critical Nginx UI auth bypass flaw now actively exploited in the wild A critical vulnerability in Nginx UI with Model Context Protocol (MCP) support is now being exploited in the wild for full server takeover without authentication.

#Nginx: A critical vulnerability CVE-2026-33032 in Nginx UI with Model Context Protocol (#MCP) support is now being exploited in the wild for full server takeover without authentication.
👇

OWASP London Chapter Meetup 14-Apr-2026 Live-Stream YouTube video by OWASP London

Our April meetup has started and we have @manicode live on stage right now coding in Claude and talking about
Securing Claude Code: Guardrails for AI-Assisted Development

Watch the live-stream 📺 here:
👇
www.youtube.com/live/icDqYJ5...

AWS Security Agent on-demand penetration testing now generally available | Amazon Web Services AWS Security Agent on-demand penetration testing is now generally available, enabling you to run comprehensive security tests across all your applications, not only your most critical ones. This milestone transforms penetration testing from a periodic bottleneck into an on-demand capability that scales with your development velocity across AWS, Azure, GCP, other cloud-providers, and on-premises. With […]

#AWS introduced Agentic Penetration Testing - while everyone is going crazy about Mythos, if you are on AWS you can have an AI Agent relentlessly finding and validating vulnerabilities 24/7:
#Pentesting
👇

Critical Axios Vulnerability Allows Remote Code Execution - PoC Exploit Released According to the advisory, attackers can exploit this vulnerability to bypass AWS IMDSv2 protections and exfiltrate sensitive metadata and credentials from cloud environments.

#Axios - yet another issue with this popular #NPM library: A newly discovered critical vulnerability CVE-2026-40175 in axios has exposed countless web & cloud apps to potential Remote Code Execution (#RCE) and full infrastructure compromise:
👇

Hackers access Booking.com user data, company secures systems Hackers accessed some Booking.com user data, including names, emails, phone numbers, and booking details. The issue is now contained.

#Booking.com warns customers of a #databreach - attackers accessed the database including names, emails, phone numbers, booking details & anything shared with the property. It is unclear if passport details were stolen too, payment info unaffected:
👇
securityaffairs.com/190757/data-...

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 Adobe patches CVE-2026-34621 after active exploitation since Dec 2025, preventing remote code execution via malicious PDFs.

#PDF Adobe Acrobat Reader Critical Vulnerability CVE-2026-34621 affects
* Acrobat DC versions 26.001.21367 and earlier
* Acrobat Reader DC versions 26.001.21367 and earlier
* Acrobat 2024 versions 24.001.30356 and earlier
👇
thehackernews.com/2026/04/adob...

So once you have figured it out, you need to train another AI with your knowledge, and configure it as a router to send the prompts to the best AI model for the job

#OpenAI is impacted by #Axios supply chain breach, its MacOS desktop apps #ChatGPT and #Codex are affected and new updated versions issued:
👇

openai.com/index/axios-...

Claude Code Can Be Manipulated via CLAUDE.md to Run SQL Injection Attacks Claude Code can be manipulated via CLAUDE.md to bypass safeguards and execute SQL injection attacks, enabling credential theft, says LayerX.

#Claude Code Can Be Manipulated via CLAUDE.md file to Run SQL Injection Attacks:

#AISecurity
👇

Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access Docker CVE-2026-34040 enables AuthZ bypass via padded requests, risking host compromise; fixed in version 29.3.1.

#Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access:
👇
thehackernews.com/2026/04/dock...

OWASP London Chapter Meetup [IN-PERSON] Join us to learn from expert speakers, network with like-minded professionals & stay ahead in the ever-evolving world of AI & Cyber Security

The next OWASP London Chapter meetup is on April 14th 2026.

Talks from Jim Manico, @diniscruz.bsky.social and Claudio Merloni.

Register to attend here:
👇

www.eventbrite.co.uk/e/owasp-lond...

I was asked if this is true or BS and a quick check in my browser showed that this is true and in fact there is even more data collected if you start digging into it:
👇

Claude Code Critical vulnerability: CI/CD Nightmare — 3 Command Injection Flaws in Claude Code CLI Allow Credential Exfiltration Phoenix Security confirmed 3 CWE-78 command injection flaws in Claude Code CLI, allowing credential exfiltration and the exfiltration of any message in CI/CD. Full technical analysis, PoC evidence, and remediation steps after the Claude Code Leak

#Claude: Three Command Injection Bugs in Claude Code CLI Allow Credential Exfiltration:
👇

New Rowhammer attacks give complete control of machines running Nvidia GPUs GDDRHammer, GeForge and GPUBreach hammer GPU memory in ways that hijack the CPU.

#Rowhammer: New Rowhammer attacks give complete control of machines running Nvidia GPUs:
👇

Claude Code vulnerable to prompt injection due to subcommand limit The vulnerability was discovered by Adversa, a security firm, after the leak of Claude Code's source code.

#Claude Code vulnerable to prompt injection due to subcommand limit
#AISecurity
👇
www.scworld.com/brief/claude...

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account Axios 1.14.1 and 0.30.4 injected malicious plain-crypto-js@4.2.1 after npm compromise on March 31, 2026, deploying cross-platform RAT malware.

⚠️#Axios #npm package which is very widely used (83M weekly downloads) was compromised, turning installs into #malware 😨
This supply chain attack has a large-scale impact: many JavaScript apps nowadays uses Axios:
#SoftwareSupplyChainSecurity
👇
thehackernews.com/2026/03/axio...

#AI: "Copilot Edited an Ad Into My PR!" - in a first report of this kind #GitHub #Copilot injected an ad into a Pull Request text:
👇
notes.zachmanson.com...

OpenAI Patches ChatGPT Data Exfiltration Flaw and Codex GitHub Token Vulnerability ChatGPT and Codex flaws patched Feb 2026 exposed DNS exfiltration and GitHub tokens, raising enterprise AI security risks.

#OpenAI: recent vulnerabilities showed how AI systems can expose sensitive data:

* One allowed sensitive conversation data to be exfiltrated
* Another enabled GitHub token theft from Codex using the branch name parameter

#AISecurity
👇 thehackernews.com/2026/03/open...

A popular Python library just became a backdoor to your entire machine Supply chain attacks feel like they're becoming more and more common.

#LiteLLM Compromised! LiteLLM - a popular Python Library used by a lot of AI tooling got compromised on PyPI, and the malicious versions are stealing everything they can find on your machine:

#SoftwareSupplyChainSecurity

👇

TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials TeamPCP compromised 2 GitHub Actions post-March 19, 2026 breach, enabling credential theft and supply chain attacks.

#Checkmarx GitHub Actions and Open VSX extensions hacked and replaced with malware by the same TeamPCP who hacked Trivy last week.

#SoftwareSupplyChainSecurity
👇

Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks Citrix fixes CVE-2026-3055 memory flaw in NetScaler, enabling data leaks in SAML setups, raising risk of imminent exploitation.

#Citrix Urges Patching Critical NetScaler Vulnerabilities CVE-2026-3055 & CVE-2026-4368 Allowing Unauthenticated Data Leaks. This looks like another incarnation of #CitrixBleed!

Defenders need to act quickly. Patch Now!
👇

Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets Trivy attack force-pushed 75 tags via GitHub Actions, exposing CI/CD secrets, enabling data theft and persistence across developer systems.

#Trivy, a popular open-source vulnerability scanner, was compromised - attackers hijacked 75 version tags in #GitHub Actions to deliver an infostealer.

It ran in CI pipelines, stealing creds and tokens, exfiltrating data:
#SoftwareSupplyChainSecurity
👇
thehackernews.com/2026/03/triv...

Achieving Secure Continuous Delivery - Chris Rutter and Lucian Corlan OWASP London Chapter Meeting 28th July 2016 There's a lot of discussion around achieving application security automation within the development pipeline. In this talk you will experience an approach to using Threadfix and its "Policies" feature to determine the security exposure of a release and

Today I am re-watching: "Achieving Secure Continuous Delivery" - a talk presented by Lucian Corlan and Chris Rutter at the OWASP London Chapter meetup back in 2016. Featuring #ChuckNorris meme:

#SecureSDLC
👇

Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE via Port 23 CVE-2026-32746 exposes telnetd via pre-auth flaw (CVSS 9.8), enabling root RCE through port 23, risking full system takeover.

#telnet: Yet Another Critical Unauthenticated Root RCE #vulnerability CVE-2026-32746 discovered in legacy inetUtils Telnet - no user interaction and no special network position required.
Telnet is still in use in old switches, routers, ICS/IoT, cameras:
👇

#OpenClaw: Never thought I'd see a picture of #Nvidia CEO Jensen Huang with claws - but here it is on my computer screen this morning and Nvidia has now launched a 'secure and enterprise-ready' open-source plugin for OpenClaw called #NemoClaw:

👇
github.com/NVIDIA/Ne...

#GitHub seems to be suffering a lot getting hit by traffic from #AI bots scraping the code these days - I keep getting 'Too Many Requests' when following links to various GitHub repos:

github.blog/changelo...

UK’s Companies House confirms security flaw exposed business data Companies House, a British government agency that operates the registry for all U.K. companies, says its WebFiling service is back online after it was closed on Friday to fix a security flaw that expo...

UK #Government Companies House confirms security #vulnerability exposed millions of UK companies' sensitive data including directors' dates of birth and residential addresses via a flaw introduced in October 2025:
#CompaniesHouse

www.bleepingcomputer.com/news/securit...

Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8 Google patches two Chrome zero-days exploited in the wild, urging updates to version 146.0.7680.75/76 to prevent attacks.

#Chrome: Google released security updates for its Chrome web browser to address two high-severity #zeroday #vulnerabilities CVE-2026-3909 & CVE-2026-3910 that it said have been exploited in the wild. Make sure to update your Chrome today! (restart it):
👇