🚨 High-severity vulnerability in #Strapi (CVE-2024-56143) allows attackers to access private fields – including admin passwords and reset tokens. This can lead to full instance compromise if your API is exposed. If you're using 5.x versions, update to 5.5.2 or later.

It's #LastWeekInAppSec time again! A use-after-free in #Poppler, a #PDF rendering library; and an IDOR in a Liferay web portal that leaks #PII. Summary below, details at buff.ly/hgQ32r9 #AppSec #CyberSecurity #SupplyChainSecurity #OpenSourceSecurity #OpenSource #CVE #Vulnerability

Use the popular `check-branches` NPM package in your CI? This tool checks for conflicts with other git branches, but it treats branch names as safe when passing to `git` commands, leading to command injection buff.ly/q3yjuvM (CVSSv4 9.3). #CICD #SupplyChainSecurity #ApplicationSecurity

📢 ACTIVE VULNERABILITY 🚨 Fortra is warning that their #GoAnywhere Managed File Transfer (#MFT) system has a serious flaw that can allow attackers to inject commands. Requires a forged or valid license, but that's not a very high bar. #CyberSecurity #DevSecOps #SupplyChainSecurity 🧵1/2

In this week's #LastWeekInAppSec (07. Oct 2025): Django allowing SQLi when backed by MySQL or MariaDB; FreshRSS letting anyone self-register as an admin. buff.ly/6aRh6uN #InfoSec #CyberSecurity #WebSecurity #DevSecOps #VulnerabilityManagement #SQLi #Django #FreshRSS #PatchManagement #CVE

🚨 ALERT: Malicious #NPM package 🚨 `@lanyer640/mcp-runcommand-server` disguises itself as a legitimate MCP server but spawns a hidden interactive shell to IP 45[.]115.38.27 when executed. We also Reported this package to NPM. #Malware #OpenSource #DevOps #DevSecOps #ApplicationSecurity #AppSec 🧵1/2

🔒 Three new #OpenSSL CVEs today: • CVE-2025-9230 OOB read/write (CMS decrypt) • CVE-2025-9231 SM2 side-channel (ARM64) • CVE-2025-9232 OOB read (HTTP client) Fixes in 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18. Update now. Details: www.openssl.org/news/secadv/... #AppSec #SupplyChainSecurity #OpenSource

Got 3 minutes? Catch up on the #AppSec news you might have missed #LastWeekInAppSec : buff.ly/dR3PQZJ This week: go-mail #opensource library has SMTP injection; Rancher subject to SAML flow abuse in Manager & CLI. Read for full details including remediation and mitigation advice. #DevSecOps 🧵1/5

📢 malicious VisualStudio Code (#VSCode & #VSCodium) packages identified. Checkmarx Zero identified the packages below and reported them to Microsoft before they were widely distributed. Microsoft responded promptly and has removed them from the Visual Studio Marketplace. 🧵1/5

Ghostscript has a stack-based buffer overflow in versions 9.* and 10.*. It’s rated only Medium, but Ghostscript underpins many PDF apps and libraries. Think of it like the “ImageMagick of PDFs.” buff.ly/GJ7Mpfj 🧵1/3

Ori Ron and I found a cool way to attack the HITL, by convincing it to inject content and markup right after commands. Anyone would press Yes if the attackers control the question.

Two under-the-radar issues — A #Jenkins DoS #vulnerability and a CA cert validation failure opening folks to #MitM with #Kubernetes clients — happened #LastWeekInAppSec, while we were all focused on the Shai-Hulud attacks. buff.ly/o8xS3ox 🧵 1/3

🎣 #PHP #Packagist maintainers being targeted by phishing attack. Contained for now, no signals of wide-ranging compromise. Great job by Packagist working with service providers to terminate the campaign. #ApplicationSecurity #SupplyChainSecurity buff.ly/OEyF84V

We've updated our #ShaiHulud blog post to reflect what we've learned in the past 48 hours. TL;DR it's looking contained enough for most orgs to return to business as usual, but it's important to follow through with monitoring and reviewing of defenses.

We're cautiously optimistic that the worst of the #ShaiHulud attack is over. These things can definitely have a resurgance over time, and we're continuing to monitor closely, but propagation has been massively slowed and it appears the exfiltration endpoint has been disabled.

The #ShaiHalud #NPM attack is ongoing; we're tracking about 600 packages impacted so far, and it continues to grow. Our customers got notifications as soon as we confirmed, but this is bad.

Using AI agents or coding assistants? You might have a LITL problem. “Lies in the loop” can bypass defenses that rely on a human-in-the-loop check. Learn more: buff.ly/whnCtFv 🧵1/4 #CheckmarxZero #AppSec #AI #AISecurity #MachineLearning #AIagents #SecureCoding

🚨 Adobe Commerce / #Magento just dropped the “most severe ever” flaw: #CVE-2025-54236. Improper input validation → attackers can hijack other users’ sessions. For an #eCommerce platform, this means fraud + reputation damage. Details: buff.ly/j3UDLHE 🧵1/4

Sitecore — a cloud-based marketing platform with AI features — is under active 0-day attack via .NET ViewState deserialization. Root cause: a sample “machine key” in Sitecore’s docs was actually valid. Details: buff.ly/XzHxq0O 🧵1/4

Last Week in AppSec (09 Sep 2025): Hono auth bypass, Netty 0-day smuggling, Claude Code trust risks. Full write-up: buff.ly/H7BB0oC #LastWeekInAppSec #AppSec #SecurityNews 🧵1/5

The transparency and responsiveness here made this attack -- which could have been really bad -- fizzle out quickly; rumor has it the attacker made less than $10 out of it 😆. Exemplary behavior by a maintainer, in our opinion.

Early analysis of the #NPM #bitcoin / #etherium / other cryptocurrency transaction stealer #malware is available on the Checkmarx Zero blog: buff.ly/60FgxFr

Our researchers evaluated Claude Code’s new security review feature. The results? ✔️ Finds simple vulnerabilities quickly ⚠️ Misses more complex issues ⚠️ Can be tricked into approving malicious code ⚠️ May even introduce new risk 📄 Full research: buff.ly/teuSapX #AppSec #AI #ClaudeCode 🧵1/3

Heads up: Edgeless Systems’ #Contrast (v1.9.0–1.12.1) has a vuln regression leaking #secrets to logs (vault creds, encryption keys, workload secrets). 🔗 buff.ly/MQXOrcZ #AppSec #Kubernetes #CloudSecurity 🧵1/3

Yep, there's still new SQL Injection #vulnerability in 2025 -- this one is #CVE-2025-49870, in a popular #WordPress plugin that manages paid subscriptions (like when you want people to pay to subscribe to your blog, course content, etc. on your WordPress site). buff.ly/sm3XvNM 🧵 1/2

CAPTCHAs were once the go-to defense against bots. But modern AI is tearing through them with computer vision, speech recognition & behavior modeling. Full story: buff.ly/IWvfK7l #AppSec #AI #Bots 🧵 1/6

🐞 Pay close attention to Kubernetes CVE-2025-5187. It’s rated Medium (CVSS 6.7), but it allows node users to delete their own nodes without permission — a handy privilege escalation for attackers to cover tracks or damage integrity. buff.ly/3a9hIcB #Kubernetes #CVE #AppSec #CloudSecurity 🧵 1/2

Amazon's close call with their #AmazonQ #VisualStudioCode extension is a case study in the need for #ApplicationSecurity teams to consider attacks against developers. 👇

Looks like we might have our first #LLM based #ransomware. Or at least a toolkit for ransomware development. 👇

If your developers are using #DockerDesktop (on Windows or MacOS), make sure you update to 4.44.3 to avoid a #vulnerability (#CVE-2025-9074) where malicious containers can break containment and make modifications on the host. See Felix Boulet's blog for details:

Here 👇 are some AppSec news items our team found interesting last week that you might have missed. See buff.ly/hvYIJI6 for details #AppSec #SupplyChainSecurity #OpenSourceSecurity #NpmSecurity #CVE #VulnerabilityManagement #DevSecOps 🧵 1/4

#LastWeekInAppSec for 19. August 2025: Code injection in AI Agent dev tool, path traversal in `go-getter`, model code injection protection bypass in TensorFlow Keras, and unsafe ImageMagick use in Rails Active storage buff.ly/clVmcTi 🧵 1/5

Time for another #LastWeekInAppSec for 12. Aug 2025: ChatGPT-5 system prompt leaked, CISA supports CVE, and AppSec Village completes buff.ly/gsnpATQ

🚨 CVE-2025-54887 The Ruby implementation of RFC 7516 (JWE) fails to validate AES-GCM authentication tags on encrypted JWEs. An attacker can brute-force/bypass the tag, breaking confidentiality and enabling crafted arbitrary JWEs. Upgrade to v1.1.1.

Looking for #LastWeekInAppSec for 5. Aug? We're taking a bye week on it to hang out at #BHUSA and #DEFCON -- look for us to get back on it next week! Meanwhile, keep an eye out for your friendly researchers (and Darren) around Las Vegas.

This article by Shelkovnikov is a great summary of git commit privacy, and why it's so important to prevent sensitive data from leaking to git. Rewriting git history after you leak a credential doesn't always remove it; you should treat it as essentially impossible "unleak" data buff.ly/sv8gmwb

We're very excited to be at #DEFCON again this year, with an event and a talk in the #AppSecVillage and shenanigans throughout the weekend. If you see one of us, come say "swordfish"

Come play with us at #DEFCON! A couple of our Checkmarx Zero members will be hosting an interactive Vulnerability Hunt challenge pod at #AppSecVillage: 🗓️ Friday 08. Aug 13:00–15:00 : buff.ly/2IL2if8 🗓️ Saturday 09. Aug 13:00–15:00 : buff.ly/cQjPSNG 🗓️ Sunday 10. Aug 11:00–13:00 : buff.ly/4UHc3oM

Want to see a free, #OpenSource, developer-friendly tool for preventing secrets leaks? Checkmarx Zero's Tal Folkman will be on-site BlackHat #Arsenal (#BHUSA) to demo Too Many Secrets (2MS), available from buff.ly/Yng76l5 Mark your calendar! 2pm (local time) on 6th August, at Arsenal Station 5

#CVE-2025-54381 → #BentoML versions 1.4.0 to 1.4.18 are vulnerable to an unauthenticated Server-Side Request Forgery (#SSRF) due to improper validation of user-provided URLs in file upload handlers. CVSSv3 base 9.9, EPSS prediction 6.02% buff.ly/0zoOTvB (🧵 1/3)

Replit AI's whole recent incident with going rogue and causing problems with deleting databases, making up users, and other frustrating and potentially harmful activities is a good reminder that AI is very far from ready to make decisions on its own.

This is a pretty cool find by Tracebit – abusing the developer trust, then using prompt injection to get Gemini to silently run malicious commands. Weaponization of this attack would be hard, but we'll see them get more capable and easier to execute. buff.ly/Eh7qF8T #AI #LLM #CyberSecurity

On July 23, 2025, the popular #NPM package #stylus was mistakenly flagged as malicious. For about 12 hours, builds broke, developers scrambled, and the ripple effects were felt across the JavaScript ecosystem. What happened? Why did it happen? And what can we learn from it? buff.ly/4uVvajn

It's time for another #LastWeekInAppSec (29. July 2025) -- AppSec items of interest you might have missed in the last week. buff.ly/1b2laNf

Hey! Are you using #SQLite in your project? Time to update to version 3.50.2. CVE-2025-6965 deals with a memory corruption issue that can lead to application crashes, data loss, or even #RCE via memory overflow. More details in: devhub.checkmarx.com/cve-details/... #AppSec

Dev alert: #stylus npm package flagged as malicious but maintainer disputes it. GitHub advisory vs. contested evidence = confusion. Don’t rush to “fixes” - attackers love chaos! Stick with your security team until there’s solid consensus. #npm #cybersecurity #dev

🔥 SharePoint #RCE (#CVE-2025-53770) exploited since July 7. Attackers stealing crypto keys via web shells to forge ViewState tokens. 9K+ servers at risk. AppSec lessons: deserialization = danger, and adversaries find bypasses to incomplete patches.

🚨 This week in #AppSec: Major Bluetooth stack vulnerabilities affecting millions of devices, NVIDIA container escape flaw, and Grafana XSS requiring only anonymous access. buff.ly/sxy6OAC Three critical security stories you need to know about 👇 #CyberSecurity #InfoSec #VulnerabilityManagement

🔔 #Malware found in NPM got-fetch (5.1.11-5.1.12); migrate to native `fetch` or upgrade/downgrade to a safe version to avoid this information-stealer malware in this #SoftwareSupplyChain attack. More: buff.ly/H8VFlAc

#LastWeekInAppSec ⎈ The Kubernetes package manager Helm has a high-severity Code Injection vulnerability CVE-2025-53547. 🚂 The Conductor open-source microservices workflow orchestrator is vulnerable to a Remote Code Execution #RCE (CVE-2025-26074) More details: buff.ly/BXWkoeF