The candidate list for the OWASP Top 10 2025 list (owasp.org/Top10/2025/0...):

So the release candidate has been will be released today (6 November 2025): owasp.org/www-project-... Comments until 20 November 2025.

SANS Holiday Hack Challenge 2025 is now available! www.sans.org/cyber-ranges...

Friendly reminder… the 2025 OWASP Top 10 should be dropping at the end of this week!

2 update paths to go down today…

This is a really tough time of the year for me. I lost my own father 7 years ago. And while it does become easier to cope over time, it’s still difficult. What makes it harder this time is seeing people celebrating the death of someone else’s father all because they don’t agree with their viewpoints

This is starting to look like this may have significant implications. 18 popular packages affected so far. www.bleepingcomputer.com/news/securit...

Great article by @jpmjr.bsky.social on @reversinglabs.com blog. Thank you for including my comments. It’s going to be an interesting time ahead with AI now playing a larger role in development. www.reversinglabs.com/blog/modern-...

I’m hoping that this is true! www.theregister.com/2025/08/19/u...

Looks like you can import from other apps…

Proton have released a new Authenticator app. Looks pretty cool! proton.me/authenticato...

A good example of why understanding what the code of AI is doing. www.bleepingcomputer.com/news/securit...

I’m completely shocked! Would have never expected this to happen! www.techradar.com/vpn/vpn-priv...

Oh dear! What a shame… never mind 😁 The sweet taste of karma! www.techradar.com/pro/security...

Where to start 😁

Source: caniphish.com/blog/cyber-s...

Humble Bundle has an interesting bundle at the moment.

Another reminder to revoke access immediately for former employees, especially ones who have been dismissed. www.theregister.com/2025/06/30/b...

I’ve given this advice to several folk, and it’s worth sharing with others. Learning how to become comfortable with not knowing something is liberating. It’ll help give you the confidence to then do something about it.

While having something showing the likelihood of a vuln being exploited is good, I do worry this will end up being just another metric. I hope that I’m wrong, and this will prove helpful. www.darkreading.com/vulnerabilit...

Anyone else seen this on Instagram?

A really important reason why it’s important to have security tooling working and operating as you expect. It’s already difficult to get other teams to buy into these tools so when they are constantly “wrong”, getting those teams onboard is almost impossible.

Important to note that CVE is not a database per se. This is why we have the likes of NVD. So if anything, ENISA would be competing with NVD. But I still have concerns of how this may fragment the ecosystem.

Just patched my car 🚙 🤣 #VulnManagement

See the EU Vulnerability Database is now live. While I get the desire to have this, the problem that I now worry about is that this is going to fragment vulnerabilities. So making an already difficult problem even harder. euvd.enisa.europa.eu

Anyone spot the flaw?

One key item of security is accountability. Without it, there’s no single person to go to get a system patched. Processes and procedures don’t get revised or updated. The same procedures and processes are not followed. And the list goes on.

A hard coded JWT. This is weird (and not mention extremely poor secure coding), never seen a hard coded JWT. These typically have a limited lifetime. This makes me think there might also be a bit more to this. sec.cloudapps.cisco.com/security/cen...

I suppose that’s one way of securing the key 😁 www.bleepingcomputer.com/news/linux/k...

Space is something else! 😍

A statement from CISA regarding the CVE program. Looks like the whole issue was blown out of proportion and many jumped to the wrong conclusion. www.cisa.gov/news-events/...

This may actually be a good model to follow instead. Being reliant on a single source has its obvious risks. This is somewhat similar to Let’s Encrypt in some sense, and look at how that turned out and the change it is having. Perhaps this is a better path forward?

Another great writeup by @kateoflaherty.bsky.social. Thank you for including my comments. I think it’s important to avoid speculation at this stage and wait for the details to come out. And then take it from there. Who knows what the eventual outcome may be.

Already seen a lot of confusion going on. It’s important to understand that Mitre does not operate the National Vulnerability Database (NVD). While NVD does ingest CVE’s from Mitre, it does not operate this database…

Interesting new risk from using LLMs to generate code. thecyberexpress.com/genai-llm-co...

Shorter lived certs are on the way! www.bleepingcomputer.com/news/securit...

😂

I'm looking for some contacts at companies that provide identity protection services, any followers out there? Further, have you had good experiences with any specific companies? There are some product placement opportunities we're exploring in the updated @haveibeenpwned.com site.

Interesting chain leading to the actual compromise. www.bleepingcomputer.com/news/securit...

Myself and @lisaforte.bsky.social will doing our podcast tonight at 8pm (UK time), on Twitch. We also need some topics! twitch.tv/SeanWrightSec

I’m so tired of finding that security tools, and some well established and known, simply don’t do the job they are supposed to. Paying a lot of money for them as well.

Likely going to be FUD around the latest iOS update. Important things to remember, it’s a physical attack that appears difficult to exploit. So likely a highly targeted attack. For most folk, they have little to worry about. But still important to update. support.apple.com/en-us/122174

@lisaforte.bsky.social and myself kicking off with our first podcast of 2025! Join us this Thursday at 8pm (UK time) on Twitch: twitch.tv/SeanWrightSec.

5am start tomorrow 😭 I’m not a morning person lol

Well good luck for them using my messages. Most are pretty one sided and only involve sales pitches 😂

Heads up CVE-2020-11023 (a XSS vuln in jQuery) has been added to the CISA KEV list. If you probably want to see if you are affected by this. www.cve.org/CVERecord?id...

If you haven’t done so yet, drop what you doing right now and go patch your instance! securityonline.info/poc-exploit-...

This points to the absolute problem with some of the BS we see with security “products”. Roll up phishing-resistant next-generation MFA. Meanwhile many of us have been using FIDO for years without all the marketing BS.

Our new complete guide to running table top exercises is now out. No paywall, no email required. Just a resource if you want it. 🫡 red-goat.com/the-complete...

👀 go.theregister.com/feed/www.the...