Security credentials inadvertently leaked on thousands of websites Researchers identified nearly 10,000 websites where API keys could be found, exposing details that could let attackers access sensitive information

Banks. Healthcare. Thousands of sites. API keys just... sitting there in the JavaScript. In plain sight. 🤦🏻‍♂️

🔑 Stanford researchers scanned 10M pages and found 1,748 live credentials exposed
😬 Some had been public for years

www.newscientist.com/article/2520...
#Cybersecurity #AppSec

We have full day of really varied talks

Jeevan Jutla will talk about how to hack like humans but without humans

Check out more at www.basconf.org

#appsec #owasp #basc2026 #basconf

7 days left to buy your ticket to the exclusive application security conference. Get a day of learning with 18 talks and 4 workshops by experts, plus chances to win raffle prizes. Buy at www.basconf.org — price refunded when you check in! #appsec #basconf #owasp #basc2026

Claude Code helps surface security hot spots and annotate secure/insecure patterns during reviews. Use targeted system prompts, monitor context windows, and prefer private hosting for IP protection. #ClaudeCode #SecureCodeReview #AppSec https://bit.ly/4mhoWSB

260328 rootshell.online Created on Sat Mar 28 23:00:00 CST 2026 - A news, tutorials and conferences about security published on YouTube - Find the RSS Feed with latest playlists at ...

Keep your skills sharp with the latest cyber playlist—stream now and stay informed. ⚔️ www.youtube.com/playlist
#CyberSecurity #AppSec #ThreatIntelligence #Ransomware #OnlineSafety

Interested in an intersection between DNA and AppSec?

Yana K is giving a talk on Crypotography using DNA and BioSafe Data Security.

Check out more at www.basconf.org

#owasp #basc2026 #basconf #appsec

CVE-2026-33989: Arbitrary file write via Path Traversal in Mobile MCP I discovered an arbitrary file write with path traversal vulnerability in @mobilenext/mobile-mcp version 0.0.48 and below, with over 60k+ downloads monthly.

Excited to share that I've got my first-ever CVE 🥳

I found a High-Severity Path Traversal vulnerability (CVE-2026-33989) in [@]mobilenext/mobile-mcp (60k+ monthly downloads).

qbtau.in/posts/cve-20...

#CyberSecurity #Infosec #CVE #AppSec #MCP

Original post on securityboulevard.com

BSidesSLC 2025 – Good Models Gone Bad – Visualizing Data Poisoning With Gephi Author, Creator & Presenter: Maria Khodak, GWAPT Our thanks to BSidesSLC for publishing their Creators, Authors...

#Network #Security #Security #Bloggers #Network #appsec […]

[Original post on securityboulevard.com]

Original post on securityboulevard.com

BSidesSLC 2025 – Good Models Gone Bad – Visualizing Data Poisoning With Gephi Author, Creator & Presenter: Maria Khodak, GWAPT Our thanks to BSidesSLC for publishing their Creators, Authors...

#Network #Security #Security #Bloggers #Network #appsec […]

[Original post on securityboulevard.com]

Big thank you to our Platinum sponsor Prime Security!

At Prime Security, we empower Security Teams to integrate risk-aware decisions into the very fabric of product development.
Grab your tickets at www.basconf.org

#owasp #basc #basc2026 #appsec

Fake install logs in npm packages load RAT Groups Conversations All groups and messages Sign in     Fake install logs in npm packages load RAT 0 views Eyal Estrin unread, 2:35 AM (11 minutes ago)    to https://www.reversinglabs.com/blog/npm-fake-install-logs-rat Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Fake install logs in npm packages load RAT #appsec

Security Analysis and Intel: CVE-2026-33017 Langflow RCE (28.3.2026) https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx Langflow Remote Code Execution (CVE-2026-33017) https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-1982.html/ CVE-2026-33017 Detail https://nvd.nist.gov/vuln/detail/CVE-2026-33017 Attackers exploit critical Langflow RCE within hours as CISA sounds alarm https://www.csoonline.com/article/4151203/attackers-exploit-critical-langflow-rce-within-hours-as-cisa-sounds-alarm.html

Security Analysis and Intel: CVE-2026-33017 Langflow RCE (28.3.2026) #appsec

Check out some more interesting sessions in AppSec

Vidhya Baskaran and Nilkanth Patil will talk about how to work towards centralizing vulnerability management

Check out more at www.basconf.org
#appsec #basc2026 #basconf #owasp

Original post on securityboulevard.com

BSidesSLC 2025 – LLM-Assisted Risk Management For Small Teams & Budgets Author, Creator & Presenter: Connor Turpin - Cloud Architect And Sysadmin Our thanks to BSidesSLC for publishing th...

#Network #Security #Security #Bloggers #Network #appsec […]

[Original post on securityboulevard.com]

GitGuardian GitGuardian is the code security platform for the DevOps generation.

The latest update for #GitGuardian includes "The Team PCP Snowball Effect: A Quantitative Analysis" and "How GitGuardian Enables Rapid Response to the LiteLLM #SupplyChain Attack".

#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb

Guided ZAP Scans: Faster CI/CD Feedback Using Static Analysis This post describes an approach that uses static analysis findings to guide ZAP’s active scans toward the most relevant endpoints. The result is a faster scanning mode suited for CI/CD pipelines, buil...

New ZAP Blog Post: www.zaproxy.org/blog/2026-03...
This post describes an approach that uses static analysis findings to guide ZAP’s active scans toward the most relevant endpoints. The result is a faster scanning mode suited for CI/CD pipelines.
Thanks to the Seqra Team!
#zaproxy #appsec

Only 9 days left to grab your ticket to the premier application security conference.

Enjoy a full day of learning and skills development with 18 talks and 4 workshops led by industry experts. Purchase your ticket at www.basconf.org — it will be refunded when you check in at the event!

#appsec

Most API security tools test what you click on. Hadrian tests what attackers exploit. 🛡️

We just open-sourced our API authorization testing framework github.com/praetorian-inc/hadrian

Full breakdown: www.praetorian.com/blog/hadrian...

#APISecurity #AppSec #OpenSource #TheGuardPlatform #Praetorian

OSSPREY

Ossprey has detected a new wave of #TeamPCP malware embedded in #telnyx versions 4.87.1 and 4.87.2 on #PyPI.

Full analysis is on our blog.

If telnyx is in your dependency tree, check your installed version now.

ossprey.com/blog/telnyx-...

#SupplyChainSecurity #PyPI #OpenSource #Malware #AppSec

ShadowPrompt: How Any Website Could Have Hijacked Claude's Chrome Extension Groups Conversations All groups and messages Sign in     ShadowPrompt: How Any Website Could Have Hijacked Claude's Chrome Extension 0 views Eyal Estrin unread, 3:58 AM (15 minutes ago)    to https://www.koi.ai/blog/shadowprompt-how-any-website-could-have-hijacked-anthropic-claude-chrome-extension Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

ShadowPrompt: How Any Website Could Have Hijacked Claude's Chrome Extension #appsec

260326 rootshell.online Created on Thu Mar 26 23:00:00 CST 2026 - A news, tutorials and conferences about security published on YouTube - Find the RSS Feed with latest playlists at ...

From pentesting tips to cloud defense, today’s curated cyber playlist has it all. 🎥 www.youtube.com/playlist
#PenTesting #AppSec #CyberSecurity #ThreatIntelligence #IncidentResponse

Learn about the greatest lie in enterprise security with Arnab Roy!

Grab your ticket at www.basconf.org

#owasp #basc2026 #appsec #basconf

SonaType - Making AI Software Development Safe at Machine Scale Groups Conversations All groups and messages Sign in     SonaType - Making AI Software Development Safe at Machine Scale 0 views Eyal Estrin unread, 2:45 PM (27 minutes ago)    to https://www.sonatype.com/hubfs/1-2025_Website-Assets/resource_files/Whitepaper-Safe%20AI/Sonatype%20Research%20-%20Making%20AI%20Software%20Development%20Safe.pdf Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

SonaType - Making AI Software Development Safe at Machine Scale #appsec

Original post on securityboulevard.com

BSidesSLC 2025 – Guerrilla GRC – Helping Small Businesses Get Cyber Smart Author, Creator & Presenter: Joshua Boyles - VP Of Cybersecurity At LHMCO) Our thanks to BSidesSLC for publishing t...

#Network #Security #Security #Bloggers #Network #appsec […]

[Original post on securityboulevard.com]

Original post on securityboulevard.com

BSidesSLC 2025 – Guerrilla GRC – Helping Small Businesses Get Cyber Smart Author, Creator & Presenter: Joshua Boyles - VP Of Cybersecurity At LHMCO) Our thanks to BSidesSLC for publishing t...

#Network #Security #Security #Bloggers #Network #appsec […]

[Original post on securityboulevard.com]

Join Fabio Cerullo’s 3-Day Web App Security Essentials training ⚔️
Exploit real vulnerabilities, understand OWASP Top 10 (2025), and tackle modern risks like AI-generated code, all in hands-on labs.
owaspglobalappseceuv...

#AppSec #CyberSecurity #OWASP #EthicalHacking #SecureCoding #Infosec

How AI agents can weaponize IDEs AI coding assistants may be turning IDEs into privileged insider threats. Big wake-up call for dev teams and security leaders. more

AI coding assistants may be turning IDEs into privileged insider threats. Big wake-up call for dev teams and security leaders. jpmellojr.blogspot.com/2026/03/how-...
#AI #DevSecOps #AppSec #AIAgents #IDEaster #SupplyChainSecurity

Original post on securityboulevard.com

BSidesSLC 2025 – The Evolution of Auth – From Passwords To AI Agents Author, Creator & Presenter: Maya Kaczorowski - Founder of Oblique, Former CPO at Tailscale And Security Lead At GitHub ...

#Network #Security #Security #Bloggers #Network #appsec […]

[Original post on securityboulevard.com]

AI innovation is moving fast. Security governance needs to keep up.

Join us, sponsor Snyk, and expert Brendan Hann on Apr. 9 for this FREE webcast on building a practical path to scalable AI security.

Register now: https://ow.ly/sqPV50YyXAA

#AISecurity #DevSecOps #AppSec

BOLA (Broken Object Level Authorization) is the hardest auth bug to catch automatically

your scanner checks "is the user logged in?"
but BOLA is "can THIS user access THIS object?"

no static tool catches it reliably — only manual review or runtime detection

#security #appsec #webdev