Calling all AppSec pros, devs & security leaders! The OWASP Top 10 2025 is in the works & your input matters. Survey closes Oct 3 - don’t wait! forms.gle/jL3r5Xgg1H...

Know I understand why Solarwinds don’t have a Bug Bounty program.

Solarwinds are trying to patch a critical vulnerability that was introduced by a patch that had a critical vulnerability that patched another critical vulnerability that came from a patch that had a critical vulnerability meant to patch q critical vulnerability.

www.securityweek.com/solarwinds-m...

I'm giving a 1-Day paid, live Training at OWASP Global AppSec in Washington DC, November 5th, 2025: API Security: Hands-On Secure API Design & Hardening Learn more here! https://twp.ai/9PUYF0 #OWASP #OWASPGLOBALAPPSEC

Later today, I'll be hosting a ModSecurity / CRS community call luma.com/8yc1p543 We'll be talking about success metrics, WAF testing and other integration questions.

Enter the cybersecurity game challenge and get your cybersecurity game printed! cybersecgames.com/pages/the-cy...

Thank you Simon Gibbs and Devika Gibbs for bringing games to cyber security. When I started OWASP Cornucopia I couldn’t find the physical cards and had to print them out on a HP Instant Ink printer, cut each out, laminate the 82 cards and cut them out again. m.youtube.com/watch?v=ByTI...

A little appreciation post to the OWASP threat modeling tools. www.linkedin.com/posts/izarta...

Just played Side-Scrolling Platformer! 🎮 Final score: 246 points on level 7! Can you beat it? Play at: github.com/commjoen/gen...

CrowdStrike got hit quite extensively by “Shai‑Hulud” npm Credential Theft lnkd.in/dJdN9THk Not surprisingly, since they show that they have very little control over their dependency management. 1. Always pin packages 2. Don’t automatically patch without approval 3. Test patches before deploying

Admincontrol doesn’t have the largest customer, but we take application security, so seriously in fact, that we don’t mind wearing funny glasses and unicorn diadems to promote @owasp.org and secure design so that other companies may shift their security efforts left too! youtube.com/shorts/L-giK...

Exciting opportunity alert! 🚀 Become a mentor at the Meet the Mentor event at #OWASP Global #AppSec USA this November. Share your knowledge, empower future AppSec leaders, and connect with an incredible community. Claim your spot now: owasp.wufoo.com/form...

I'm giving a 1-Day paid, live Training at OWASP Global AppSec in Washington DC, November 5th, 2025: API Security: Hands-On Secure API Design & Hardening Learn more here! https://twp.ai/9PTEfL #OWASP #OWASPGLOBALAPPSEC

What to do this weekend? #Play some #free #games! Here are 3 experiment made with #AI that we enjoyed a lot! github.com/commjoen/sef... github.com/commjoen/gen... github.com/commjoen/3dg... Please give the repo a ⭐️ if you like the game!

Are you an OWASP Member? Our 2025 Elections are coming soon, and only OWASP Members are eligible to vote. Join or renew today! Memberships start from $20 USD or $50 USD a year, depending on your location. Help sustain our mission and drive our impact! owasp.glueup.com/org... #membership

All models are wrong, but some are useful. It helps to state the goal. A Lego rover is fun — and teaches. A NASA trainer simulates moon gravity. Same object, wildly different ROI. In threat modeling (and life), clarity of purpose beats pretty diagrams. is.gd/Z0Nodf

Implement security tools and processes and do threat modeling using a people-first approach. OWASP Cornucopia and agile threat modeling are about what is essential to the people you work with, not ISO 27001, SOC2, or Mitre. #agile #threatmodeling #cornucopia www.youtube.com/shorts/SinVk...

Agile Threat modeling is about respect for the team’s experience and expertise and about what is important right now! Not tomorrow or yesterday. #game #appsec #cornucopia #agile youtube.com/shorts/AGx_O...

I regularly get asked by people whether I would go to OWASP Global, Blackhat or Defcon. I would like to, but my threat modeling tells me to stay put. My family would be scared and my wife would go cracy. I would be scared too. It’s going to be Europe for me for the foreseeable feature.

I regularly get asked by people whether I would go to OWASP Global, Blackhat or Defcon. I would like to, but my threat modeling tells me to stay put. My family would be scared and my wife would go cracy. I would be scared too. It’s going to be Europe for me for the foreseeable feature.

My talk at @containerdays.bsky.social this week was on Kubernetes and post exploitation. I've had a couple of requests for a companion blog post, so here it is. The post looks at some things attackers might do in clusters they've compromised to retain access. raesene.github.io/blog/2025/09...

In the fifth episode of r19.io – Hackers Behind the Code, I had the pleasure of welcoming Johan Sydseter, co-leader of the OWASP Cornucopia project and creator of AppSec Pokémon. 📺 Watch on YouTube: www.youtube.com/watch?v=Tcmm... 🎧 Listen on Spotify: open.spotify.com/episode/7KDs...

If you want others to do threat modeling for you, then please, for the love of god, at least, make it a bit fun! copi.owasp.org cornucopia.owasp.org #owasp #cornucopia #appsec #threatmodeling #threat-modeling

A pleasure to be able to come and talk with you Milton Araújo For anyone else, join us to hear about scaling #threatmodeling #cornucopia and our thoughts on #appsec youtu.be/_Yz2Bfexxa4?...

My friend Odd Noreide just finished his first album. I really liked «Å gå seg vill», «to get lost»: open.spotify.com/track/5eOMUp...

Are you an OWASP Member? Our 2025 Elections are coming soon, and only OWASP Members are eligible to vote. Join or renew today! Memberships start from $20 USD or $50 USD a year, depending on your location. Help sustain our mission and drive our impact! owasp.glueup.com/org... #membership

Our OWASP 2025 Global AppSec USA agenda is fully built out now to view on our website! Get ready to jump into three full days of hands-on training starting November 3 in Washington, DC. 🔗 Register: owasp.glueup.com/eve... #OWASP #AppSec #ThreatModeling #Hacking #Cybersecurity #WashingtonDC

The next OWASP London Chapter meetup [in-person] will take place on Monday, September 22nd 2025 at 6:00pm. The details and registration: 👇 www.meetup.com/owasp-london...

Latest “Secure by Design” roundup: CISA’s still pushing SBOMs, but liability’s the real shift to watch. Software makers may soon own the risk they’ve been externalizing for decades. Worth your attention. is.gd/8WaWoM

If you attended my vibe coding session at the @OWASP Community at @defcon (or you didn't but you are interested) and you want to continue the conversation, Emile Delcourt opened a dedicated channel on the @OWASP slack workspace: owasp.slack.com/arch...

You can still join us on Tuesday, September 9, from 2 pm to 3 pm CEST. Just send me a message with your email address, and I'll send you an invite! Read more about it at: dev.to/owasp/owasp-...

At OWASP Cornucopia, we have long stated that we will create more decks, and now we will! Suppose you still want to participate in creating the OWASP Companion edition to commemorate the 25th anniversary of the OWASP Foundation, but haven't had the time to think about it?

At OWASP Cornucopia, we have long stated that we will create more decks, and now we will! Suppose you still want to participate in creating the OWASP Companion edition to commemorate the 25th anniversary of the OWASP Foundation, but haven't had the time to think about it?

Everyone’s pitching “threat modeling with LLMs.” Problem: they sound smart, but often mislead. Useful vs nothing? Maybe. But accuracy, fragility & overconfidence remain big risks. Sidekick, not savior. Thoughts: helpful tool or dangerous distraction? #ThreatModeling #AI shostack.org/blog/manspla...

I am also looking forward to having a beer with like-minded security enthusiasts and so to all old and new friends. Come and say hi! #appsec #sikkerhetsfestivalen #security

On our `develop` branch and the public preview instance preview.owasp-juice.shop you can try out our overhauled hint system! Users can now unlock multiple hints in the app itself instead of just getting one hint and a link to our Companion Guide! (🧵1/2)

I am on my way to Sikkerhetsfestivalen at Lillehammer. Anyone joining me today at 1:15 pm CEST will be learning to play OWASP Cornucopia in a different way from what we usually do.   www.sikkerhetsfestivalen.no/talerliste#s...

📢 The Norwegian .NET User Group Oslo, NNUG OSLO, is ready for its post-summer kick-off, and I am happy to announce that I will be speaking at their September Meetup on Tuesday, September 2nd! 🍕 Pizza from 16:30. 🚨 Please make sure to register at the meetup page: www.meetup.com/nnugoslo/eve...

Please donate blood today! Learn about Sherif Mansour's fight with acute myeloid leukemia, and how you can help everyone with blood cancers by donating blood today. owasp.org/blog/2025/... #donateblood

We released version 1.12.3 of #OWASP #WrongSecrets at github.com/OWASP/wrongs... ! With a new challenge and tons of additional updates. Want to try it out? go to www.wrongsecrets.com and give our repo a 🌟 if you like it!

📢 The Norwegian .NET User Group Oslo, NNUG OSLO, is ready for its post-summer kick-off, and I am happy to announce that I will be speaking at their September Meetup on Tuesday, September 2nd! 🍕 Pizza from 16:30. 🚨 Please make sure to register at the meetup page: www.meetup.com/nnugoslo/eve...

Please donate blood today! Learn about Sherif Mansour's fight with acute myeloid leukemia, and how you can help everyone with blood cancers by donating blood today. owasp.org/blog/2025/... #donateblood

Threat Dragon version 2.5 released: github.com/OWASP/threat... This release has some enhancements: * Add demo models from the Threat Model Cookbook * Multiple Diagrams: copy diagrams from the edit page * Extend DIE to be CIA-DIE * Updates to Portuguese translation

🌟Get involved in shaping the future of OWASP by submitting your nomination for the 2025 OWASP Global Board of Election! If you are an OWASP member, please check your email for the election details.

The OWASP GenAI Incident Response Guide gives security teams practical tools to tackle new risks in generative AI—from prompt injection to rogue agents. jpmellojr.blogspot.com/2025/08/owas... #OWASP #GenAI #AIsecurity #LLMSecurity #AgenticAI

A great way to kick off what I’m calling “Season 2” of the “Smashing Security” podcast! Dave Bittner joined me to discuss a poisoned Google Calendar invite hijacking smart homes, and how a man was hospitalised after ChatGPT told him to season food with… pesticide. open.spotify.com/episode/6Snq...

In a recent investigation it was found that doctors would find less cancer when trusting the AI to do the work. www.thelancet.com/journals/lan... Why? Because they trusted the AI more than their own skills. Lets be honest…

A new project: 144mb of Infamy A few weeks back, I started a bit of a passion project. I wanted to capture the faces of the '90s and early 2000s hacking scene using the tech of the time. We're talking a Sony Mavica camera and a vintage computer for editing.

Want to make a impact in our community? Submit your nomination for the OWASP Global Board of Directors. The 2025 election process has started. If you are an OWASP individual paid member, please check your email for the details on how to submit your nomination. Help mold the future of OWASP!